There's another side to this. The people deploying things with a security group open to the internet and no auth might have been saved by a grumpy network admin

There's another side to this. The people deploying things with a security group open to the internet and no auth might have been saved by a grumpy network admin forcing them to use a VPN or even a firewall, but that's IMHO only hiding the real problem ( security not taken seriously) behind a thin fence. When that fence gets breached, everything would be up for grabs, so the main difference with "the cloud" is that such terrible security postures are easier and faster to spot ( from both sides). Zero trust everything.