Yes. Some vendors have mitigations against that (Oracle have done significant work in this respect), but otherwise there's no especially good reason to believe

Yes. Some vendors have mitigations against that (Oracle have done significant work in this respect), but otherwise there's no especially good reason to believe that public bare metal providers are giving you trustworthy machines.