Well its called managed infrastructure for a reason.
But it should be possible for a client to audit all accesses, and the audit logging system be robust enough to catch evil employees.
If your threat model is a single rogue employee, auditing systems address the issues. If your threat model is "the whole company works against you", you probably shouldn't be using any company to host your infra, so host it yourself, because there's no way to be secure in that situation.