You might see them. But it's far easier for a dev team to take control of the ops side in the cloud with IaC, API's and automated tooling like Terraform. It's still very hard to find companies that do on-prem, API first.
You didn't get the point. Your cloud provider can do things that you don't see and can't control. If you think all cloud provider's employees follows best security practices because they told you so, then good luck.