I *think* a lot of the clear-net stuff that is cloud hosted is from businesses running their nodes.
Their website and back end commerce is already at Amazon cloud or Google Cloud or wherever so that stays there too.
This is probably true, but this is making Lightning Network much more centralized than it should be.
If something happens with major cloud providers that would shut down most of the LN nodes and capacity would see drastic reduction.
I know VoltageCloud is actually using googlecloud, and any privacy on LN is also questionable when we know all this.
As for most users, running one of the nodes in a box that I love or any pre-packaged LN node it's usually just a click to do TOR, or in the case of Umbrel something you can't unclick. So things like that probably make up a large portion of the TOR nodes. Where people want to do it, but don't want to do it by hand so to speak. Which is fine, I want to drive my car I don't want to know how to refine gas.
There are now so many options to choose from (myNode, raspiblitz, etc.) and Umbrel is just one of them.
Sorting by capacity isn't really accurate though. If you sort by Node, you'll see better distribution (although Amazon still has 16.64% share).
You can sort them any way you like, but majority of nodes are still on cloud servers.
Centralized exchanges are probably using cloud servers, for example I can see that Kraken exchange has Amazon ISP, Okex exchange uses Alibaba, and Bitfinex is using Google Cloud.