Most of the current crop of Cloud Providers do nothing more than OnSell Leased Server Space the same as a lot of the Telco's and have no actual Hardware themselves.
Hence many of them are the Small Business likely to go broke in their first few years.
Data Security is most defiantly one of the Big Ones here and as you say Small Business is already 100% Responsible which at the very least makes them think even once if they employ a half way decent IT Consultant instead of their neighbors 15 Year Old Boy who is Great with computers and knows nothing at all about business.
At the very least their Accountant warns them to be careful because if their wifes find out how much the business has they could have
Issues at home. That in my experience makes most think twice and do the bare minimum to keep people out who shouldn't be in there.
Of course if the Wife gets in and finds out just what is available for her to spend Data Security takes off in that Business and they get Paranoid.

However the problem isn't with the Cloud Provider
The large providers need to be, or they risk running out of business.One Big Provider not being Security Conscious takes just how many Small Business along for the ride? All it takes is one of the Big Providers who Lease Server Space through several Smaller Providers to adversely impact on everyone. The problem here isn't so much what your Provider Offers but what their Provider Offers.
You could for instance have 2 distinct Cloud Providers one who claims to be Super Paranoid on Security and one who doesn't mention Security and Hard Sells Cheap Prices. The reality is that both of these Providers could be Leasing Server Space from the same Big Cloud Company and their Marketing Campaigns are just that Marketing Campaigns driven to a certain sector of the Market with little to no grounding in facts.
Currently the
"Self Hoster" can not get insurance to cover them for their Stupidity which is as things should be but if you go and Jump into the Cloud and Trust your Provider you can still not get any Insurance Cover to protect you or your business from that Cloud Provider Slap Shod policies so you get all of the disadvantages with only a slight reduction in costs as a benefit.
Not my idea of a good way to do things but then again maybe I'm just stupid.

Col