All the cloud services I've used had virtual network firewalls for internal traffic. Security Groups for AWS, Cloud Firewall for GCP, etc. That's typically how lateral traffic gets managed. Defense in depth is good, but as I said I haven't used host firewalls in forever, and we get audited for security certificates every year, and no auditor has asked about them that I recall.