We use Serverless lambda + api gateway + cognito, there is no room for getting hacked.
While leveraginvg serverless gives a lot of benefits in terms of hardening and infrastructure setup, all the traditional application security issues (e.g. OWASP TOP 10) like SQL injection can still apply.