On-premise, with or without VMs, does not safe you from rowhammer, however. That's just another use case, and not really surprising. Since you can modify RAM, there aren't borders really.
At least one of the big hosters even lets you have VMs for free for a couple of days (you get your money back if you cancel). That's more than enough time for an automated process to check out tons of VMs (to add to your botnet) for free.