But if you don't, your threat model is a work of fiction and you're wasting your time play-acting. A threat model has no basis in reality if you do not accurat

But if you don't, your threat model is a work of fiction and you're wasting your time play-acting. A threat model has no basis in reality if you do not accurately model threats, and your infra vendor is a glaringly obvious threat. Now, maybe that's a risk worth the tradeoffs, but how do you know that?