Comment by geerlingguy

A system like Ansible, in particular, doesn't install anything resident on the servers it manages, nor manages state which could be exploited on a management machine. And in one sense, it's like writing a shell script and running it on the server via SSH. Manual provisioning scales well enough for a single server but is much less secure when you scale past one server, or need to be able to rebuild that server in a hurry, like when your cloud provider inevitably deletes it.