Yeah, sure, but they don't set up those services themselves, but they buy the whole solution from a vendor, usualy together with hardware provided by the vendor

Yeah, sure, but they don't set up those services themselves, but they buy the whole solution from a vendor, usualy together with hardware provided by the vendor. So they still get a all-in-one solution from eg. NSN or huawei, and the vendor sets up and does the initial configuration for the operator. (what I wanted to say is, that they don't take an empty server, install some linux on it, install kubernetes, and deploy each service one by one, but they buy it "all-in-one" from the vendor, so if there are security issues, they're usually because the vendor fucked something up)