It’s a question of degree. The cloud is at one extreme end. An air gapped system running only open source you have audited is at the other extreme end.