Because AWS uses automations to a large extent to manage services, AWS does not forget to patch a service, nor does it commit typical human errors that produce inconsistent results.
Abstract services allow you to get rid of the infrastructure associated with the service, and from the maintenance activities for that infrastructure.
As qualified specialists are the scarcest resource among security teams, the most mature companies choose abstract services (serverless) whenever possible, thus reducing management work and attack surface. View Shared Responsibility Model