When I worked at AWS they were insanely hardcore about mandating physical access controls, that is all I’ll say, even to the point of ridiculousness. For all the things AWS does poorly security is not one of them.

If I were to guess CF is locating their PoPs at cheap peering points and the reason they are evading the question is because other customers in the facility have physical access to their equipment, which is both an expensive problem to solve and something that is not even remotely allowed at a real cloud provider.

That's definitely a thing. Additionally, humans are surprisingly friendly in all the wrong ways when it comes to physical security (tailgating, "forgotten ID/credentials", etc.).

I've visited data centres (with various impressing sounding accreditations) where the doors have been wedged open because the employees found the security annoying

I've also had DC employees, without authorisation: reboot my machines, give themselves access rights and then tamper with my systems

admittedly the latter was a long time ago, before any of this stuff was considered critical infrastructure

these days they'd probably end up in prison

cough https://www.datacenterdynamics.com/en/analysis/ovhcloud-fire... (physical security isn't just access control)

Just because there hasnt been a story doesnt mean its not important or critical

you must not deal with compliance (and bless you for it)