Given the heightened awareness around all of the recent news, you can safely assume people are actively looking for existing backdoors in firmware. Theorizing

Given the heightened awareness around all of the recent news, you can safely assume people are actively looking for existing backdoors in firmware. Theorizing about a single provider is a bit unfair, especially given there are other services who are actively engaging in business with intelligence agencies. It would be much easier and more reliable to just snapshot your instance and do work on it offline instead of trying to do a remote exploit on the hardware running it.