Sure, but still, attack surface could and should be minimized by rethinking what exactly even needs to be on a server the general public can use.

There are a lot of security problems you can categorically rule out by simply not involving a cloud. Clouds have been involved in a lot of things, because everyone was doing it, and because that's how you can collect rent, but they aren't really necessary for most use-cases.

So we could definitely get the exposure down there. We'd just have to fundamentally shift the defaults of this industry.