You do know that "serverless" still runs on a server, right? And if you aren't configuring the server your code is running on, someone else is.

Serverless is lying to yourself about who your neighbors are. Anyone could be running spectre attacks or rowhammer on the physical host you're sharing. At least when you spin up your vm you can pay to keep your own cores and the hyperthreads.