The reason we were talking about on-prem is because we're talking about the effort of doing these things yourself vs farming it out to a third party.

If you're a security engineer responsible for securing only:

1. a public website

2. stuff that can be ip whitelisted and/or use mTLS

Consider yourself very lucky. Most orgs need to expose a lot more than that.