I've never heard of anyone buying excess cloud capacity from a private party. Is this a thing? Is there a market for this? Sounds like a security nightmare.
Security wise it's no different than any other instance; specific machines aren't associated with the party who originally reserved the capacity in any way.