What's your most controversial take on cloud security responsibility?

The shared responsibility model sounds clean on paper, but real-world incidents expose gray areas constantly. Where do you draw hard lines between provider negligence and customer misconfiguration—and which common assumptions about cloud security are dangerously wrong?