It absolutely does. I have pulled their docs many times to show their guard dog service kills VMs if malware is signature identified. I feel like you may be thinking first order effects and not secondary and terceary effects. I swear I am not as dumb as I look, and I don't take Luke, Mechanic, Murch, Antoine, Voskiul, or any other dev or talking head at face value. I take what they say and check it for validity.
Discussion
https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3.html
These docs?
And we've gone over the whackamole with malware signatures. My previous company worked the red team for DoD. I promise you don't understand the cloud like you think you might.
I also welcome all AWS bitcoin nodes failing. My sats remain safe.