Correct. You could always use your own server from another provider, or use Azure/GCP/AWS instead, but nothing prevents them from blocking IPSEC to common cloud/web hosting providers.