boldsuck It's no different with managed dedicated servers. Their management layer can take control of them. After all, they're capable of automatically handling cancelling a subscription and handing it over to someone else.
Full disk encryption on desktops, laptops and servers provides very little protection against a physical attacker while the machine is booted. Colocated servers don't have that management layer managing them but they're still at the mercy of the people with physical access, and in practice that essentially includes a whole bunch of other people colocating servers in the same DC so it's not necessarily a good tradeoff... Server hardware does not provide similar protections to an iPhone/Pixel against a physical attacker, not even close. They try to check off a few features from a list but do not even have real verified boot, etc. Generally, you can hook up debugging cables to the motherboard, etc. and do essentially whatever you want with no barriers to it. It's not taken at all seriously. Google and now Apple are both trying to change that, but hardly anyone else is, and to benefit from that you'd need to use GCP and trust their management layer, etc.