There are several cloud providers that offer "baremetal" hosting where tenants are allowed root-level access to the OS running directly on the hardware. What is the risk that a previous malicious tenant installed a firmware-based compromise that would grant them root-level access past reinstall when one of the kernel modules attempts to interact with that malicious hardware/firmware?
It is unlikely, but not impossible.
As previously mentioned, cloud hosting services use hypervisors to isolate VMs from each other (if there is more than one) and to isolate the VMs from the underlying OS and hardware.
Hypervisors, however, are not immune to vulnerabilities. Here is an example of vulnerabilities affecting Xen (a popular hypervisor). Not all vulnerabilities allows an attacker to break out from the hypervisor, but it happens.
Let us consider an attacker that successfully escalated its privileges to hypervisor level. In addition, the attacker needs to find vulnerabilities to insert a backdoor/implant in the firmware itself. Again, this is unlikely, but not impossible. It is possible that the firmware integrity is not verified at boot time or during an update. It is also possible that the firmware vendor did not respect the specification or that there is a vulnerability.
The combination of successfully finding and exploiting vulnerabilities in a hypervisor and firmware is low, but not impossible.
Knowing if such risk is worth considering depends on your threat model. For example, it is worth considering in the case of a highly motivated and resourceful attacker.
One would still argue that it would be simpler for the attacker to use another vector. For example, a phishing campaign targeting the cloud provider employees?
Pretty unlikely in reality since the majority if not all of these services won't actually give you access to the firmware.