In principle, it's always been about "shared responsibility principle".

But in practice, yes many clients probably assume that by running in the cloud, they're "secure" (thus, failing their end of the bargain).