They state that “the managed runtime environment reduces the attack surface compared to a more traditional server environment”, but is that true? Isn’t it just

They state that “the managed runtime environment reduces the attack surface compared to a more traditional server environment”, but is that true? Isn’t it just that the attack surface that you are responsible for is reduced? I could see all the lambda “magic” (i.e., reducing cold start times) actually adding to the runtime attack surface.