This comes down to the similar argument where you might say that your telecommunications company knowingly transmitted malware between its customers.

And again its a balance between user privacy and not allowing malicious activity to occur on your platform, much like CSAM.

I can't see an easy way for cloud companies to continuously monitor and be responsible for all of the content shared on their platforms. Unless we launch some enormous hashing technique which actively identifies, detects and removes malicious content, whatever that may be. I then see this being halted by false positives which humans would need to then manually consider.

I don’t trust anyone to scan my files for “bad things”. If nothing else, I’ll put my own encryption layer between myself and cloud providers.

Oh yeah I can vouch for this, many malicious sites are hosted on Microsoft's own servers like onedrive.

There's not much you can do in terms of IP blocking or domain blocking when microsoft is hosting the malicious webpages from MS servers. It's a challenging issue.