Risk management is typically done by quantifying the chance of something happening and also the impact to the business if that happens. For data leakage risk, the impact can be extremely high for companies that have intellectual property (IP) which if disclosed to a competitor would cause loss of market share down the road (because the competitor got the blueprint to the companies next big thing and went to market with it first). Or, the impact can be devastating impact to reputation, or regulatory fines or even criminal charges. So usually you gauge the impact as being extremely high.
The probability of that happening depends on a lot of things, such as whether their are any controls around the IP in digital form. Is it encrypted? Is access controlled? Is there monitoring in place to detect suspicious access to that IP? That is just a few but the list of controls that should be in place to protect digital IP is long.
In addition to controls, you also gauge how feasible it is to get that stolen IP off the premises. Again, the list of controls is long but to name a few: Locking down desktops and disabling portable storage like USB, implementing email controls to detect and prevent emailing of that IP, network security that prevents accessing cloud storage services (dropbox, etc), network security that makes it impossible to get an endpoint onto the network that isn't under the control of the company, e.g. a personal laptop, raspberry pi, etc.
So the answer to your question on how high the risk of data theft is "it depends" on a lot of things, which is going to vary from company to company.
Yes, the title and the question are out of alignment. Stealing server hardware is just one way proprietary information can be stolen. I don't even consider that a possibility because the last time I saw a company with servers not in a well-controlled data center was back in the 90s. That doesn't mean it can't be done, but again how likely that is depends on the controls around access into the data center and equipment moving in and out.
Assessing this risk really has to be done on a case-by-case basis, and to be done right needs to follow an assessment of the controls that impact this risk rating.