Hacker News Reader

I figure it's because AWS can get away with it.

AWS deploys using cfn internally

This is only partly true.

The foundational services do not use cfn for the vast majority of their deployments.