Your statements apply to self-managed VMs, yes. But in that cause, security is still on you, just as it is when you have an on-prem server farm. Being in the cloud doesn't help or hurt you.
Now we are getting closer to reality. Of course it hurts. It costs more money, adds unnecessary latency and there are new burdens in the form of controls, payment, management portals and vendor maintenance windows.
The story is very different with managed services. The provider has deep knowledge of what your software does. They know if you are hosting a website, and what security protocols are permitted for accessing your website. They know what version of web hosting software is being run, and (when you are using managed services)
Nice, so if I just plop my website content on someone else's web server they are running for me I don't have to worry about it. This begs the question what such a sentiment has to do with the statement "Simply switching to someone else's servers accomplishes none of the above" how does one presume "websites" from my statement?
they actively perform security updates on your behalf.
So does every Linux distro.