This has always been my concern with Linode and other cloud VPS providers. You can secure the server all you want, but you can always get in via a vulnerability in their API or out of band console access. 2FA helps a lot to prevent access to Lish/Glish/Rescue mode console but as shown the API is powerful enough to still be a potential problem if your key gets leaked somehow.