The Cloud Pentesting Problem: Why Traditional Security Models Stop Working at Scale