Anyone concerned with that threat model can host their own instance on whatever hardware they want.
They could have the middleware load balanced over aws/azure/gcp/hetzner/at-home and have load-balanced replicated postgres also running on those hosts.
They could use CDN & threat protection from those cloud providers as well as cloudflare. And really distribute the threat of that situation.
But nobody wants to fork out $$$ every month before they are even scaling to thousands of users, never mind the added complications of middleware from one provider trying to interact with a load balancer on another provider which is forwarding to postgres on a different provider, let alone geographic latencies.
Then trying to manage that, never mind the headache of an update.

But, if that is someones threat model, then they CAN work around it.

Companies owning the actual servers and infrastructure is at the level of enormous scaling (like twitter) or high risk (like banking, even then chances are they are running hardened systems that would be secure on anything).
Most companies will pass that responsibility off to a single provider, and rely on that providers skills/services for uptime