The issue is with companies having absolutely garbage security practices.
They used social engineering to stay ahead of detection.
My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.
And that is the security responsibility nobody wants to be part of. Neither AWS and neither the organization that rents the machine.
It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."
Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...
Of course, this is complicated and a big part of the reason cloud is so successful is that the engineers capable of doing complicated stuff are hired by the cloud providers. My pet theory is that FAANG pay so high salaries to prevent competition and home-grown solutions as much as possible by attracting the top x% of the talent pool.