You're right that's a huge issue also - And Amazon (to use your example) also takes great pains when engaging with customers to stress that their security competencies and certifications absolutely do not extend to a customer's use of their platforms.

For an obvious example, if Amazon has PCI DSS compliance and a customer comes along and builds a payment gateway on AWS services, that customer is not also PCI DSS compliant by extension.

But this thinking extends to all of the security assertions/certifications/measures that Amazon puts forth.

That is to say, 'we secure the platform but you can absolutely make an insecure mockery of a system on top of that platform'. In all cases you must implement your own security protections and processes on top.