What's your take on the security implications of serverless architectures becoming the default for new projects?

Companies are increasingly shipping serverless-first, but the attack surface shifts dramatically—cold start exploits, function chaining vulnerabilities, and IAM misconfigurations replace traditional server hardening concerns. Are we trading understood risks for invisible ones, or is this actually forcing better security hygiene through immutability and least privilege?