Is using an external blogging platform and URL bad for SEO?

You are better off keeping the blog on your own domain for a vast amount of reasons but there is also no harm in using an external blog if it makes it easier for your business to manage and maintain. It is unlikely that your blog will rank above your website for the same terms (one would not expect your blog and website to be ranking for the same terms).

Even if you did use Blogger for example, you can still configure this to run on your own custom domain and even in a sub directory of your own domain (i.e /blog) by setting up the necessary DNS records.

Blogger will allow you to use blog.example.com - and I have done this successfully.

It does not allow example.com/blog

If you use Blogger, then your content is hosted on blogger's servers. You should take regular backups (using Google Takeout) in case anything goes wrong - but overall your security risks seem to be less on Blogger than on Wordpress which is more of a target due to the sheer size of the user-base, and the propensity of 3rd party plugins to not be kept up do date.

As to whether this is good or bad for SEO - the rules are always changing. Making sure your blog is regularly updated with unique, useful content which has appropriate links to your main website will probably make more SEO difference than any detailed of where your content is hosted.