In a past life I worked at AWS as a support engineer

I once got a ticket from T-Mobile (US) asking what "AWS's best practices were around security patching. How long should we wait?"

A week later they admitted to an enormous data breach

I'd say I switched phone carriers after that, but after working in the ISP market I already knew they were all absolute clown shows where all the money only went to C-levels and not infrastructure or security