I want a WAF in front of EVERYTHING I have. This includes being able to apply rate controls/DDoS protection, etc.
Even if rates for bandwidth are "cheap"... If an attacker sends a trillion requests for the objects, I don't want stuck with a huge bill.
If you're going to talk about "lock-in", solve it by using multiple providers that offer complete stack solutions such as Azure or Google where you have the database, application, security, caching, micro services, etc all brought into multiple providers. Simply moving CDN out somewhere else is not a good way of designing an enterprise level application.