You don't need a software factory. You need an abstract software factory provider which can instantiate concrete software factories without coupling the client to a specific software factory implementation. Have some fucking self-respect.
These security vulnerabilities are not a big deal to those of us who embraced the SERVERLESS REVOLUTION and maintain hundreds of Lambdas instead of patching servers. WHOS LAUGHING NOW??