I believe because it isn’t cost effective in the cloud there just isn’t much if any legitimate mining being done. Most cases are fraudulent in some way. Fake credit cards, stolen credentials, misusing company resources, and other types of efforts to mine, but not actually pay.

Cloud providers would rather just not provide that service, detect and stop it before it gets too out of hand.

The handful of times I’ve personally encountered it, it was always some sort of fraud. Notices from the cloud provider were how a given company found out about it… before the surprise alerts or bills.