Sadly this is entirely predictable.

Some time ago my colleague and I were doing some due-diligence on Bunny as a potential service provider.

We asked them some basic security questions, nothing low-level, just some basic high-level overview type of stuff to roughly check if they were following well-known best-practices.

Their response was a consistent and constant "cannot tell you due to security reasons".

That rang alarm bells. Any provider such as them who is not sufficiently confident in their security to be willing and able to discuss security at a high-level perspective is not worthy of trust as far as I am concerned.