There's a privacy issue in both directions too: the tenant will be afraid their workload will be stolen, and the host will be afraid other data in their system

There's a privacy issue in both directions too: the tenant will be afraid their workload will be stolen, and the host will be afraid other data in their system will be stolen (if the sandboxing is imperfect).