This isn't a smartphone. It is a server that other people (that you specifically get to target) have to use.

It is your responsibility to verify your supply chain. If you can't do that, maybe you shouldn't operate a website that collects user information.

At least before cloud you would have to set up bare metal services which gave people an idea of what they were actually assembling. The fancy control panels and one click installs have created a group of overly entitled administrators who can't admin and won't take any responsibility for running shit, misconfigured, off the shelf services from companies they didn't even vet.