Hybrid search and late-interaction reranking are the technically substantive half here, and one thing is worth separating for readers: bare metal versus serverless is an economics and control decision, while hybrid search, reranking and injection defence are architecture decisions that apply identically on either. Conflating them makes the technical advice look like it depends on the hosting choice when it does not.
On injection specifically, the honest framing is that no retrieval-layer defence makes an injected instruction harmless. What limits damage is keeping the dangerous verbs behind tools with their own authorization, so retrieved text has no path to them regardless of where the index runs.