This bug only seems to widen that vulnerability slightly, to those groups plus those with knowledge of this bug.
Nothing in major US cloud providers can reasonably be expected to remain private, so I think this breathless headline is a little overblown.
I'd expand that to "Nothing in third-party cloud providers can reasonably be expected to remain private". If you don't have ultimate oversight of how the host of your data is managed, anything could be going on there, regardless what nationality of company is managing it or what promises their salespeople make.
Unless you have some secret kung-fu that makes your on-prem infrastructure hack-proof.
The issue with the cloud is scale.
I’d argue the issue with cloud is less about scale, more about how easy it is to get started. My mother could quite easily click through the account creation on a cloud provider and setup something insecure, but not a chance is she going to get a DC built with equipment racked or even a basic setup at a colo facility.
You cannot imagine any other party it would be worse to be vulnerable to?