In practice it's a rather thin attack surface and serious cloud providers rely on it so it's both well-tested and any exploit can be used on much more valuable targets than your OS.

It's not a panacea. There are physical threats, there are threats from the very hardware you're using. But, like it says on the box, it is a reasonably secure operating system.