You’d be surprised. We had security that rivaled even the standards required by the banks. Truly crazy high multiple physical key paired with vault and some faraday cage protected offline signing thing — I wasn’t privy to it all just saw bits of it while it was being implemented. Suffice to say it can be done and by going off cloud you get the flexibility to do things like this but... in the end it’s overkill