Not that complicated: - you have to trust cloud providers aren't handing off the access keys when demanded - zero days exist and get leveraged to obtain access even if you do trust providers - many companies have long tails of allocated resources at providers that they do not use or even know what they're there for