Cloud does let you do this with VPCs and subnets. Some people don't bother and end up susceptible but it remains best practice even for cloud software
Developers have decided that the convenience of just letting their servers pull arbitrary code off the Internet is more important than the security risks.