How can services hosted on AWS have vulnerabilities despite there being a lot of security service offerings like WAF, KMS and PrivateLink?

Question

There are a lot of managed services like AWS PrivateLink, Direct Connect, IAM Policies, KMS etc. that can help us create virtually impenetrable hosted services, but still we