Good question. Our goal is not just to run arbitrary code but to run it fast and cache rework. We are a CI service and speed is important. Brandon may be able to jump in with why not various options but it's hard to beat giving users powerful cloud machines to run their builds on.
I myself did try to run buildkit in a Lambda as I think that would be low cost option. But I found it you couldn't make gRPC calls against a lambda and that is a hard requirement for us.
Some of the reason we went with EC2 over something like ECS is that we would need to run the container in privileged mode for some of our features to work. We also considered options like gVisor, but ultimately the EC2 route was a simple enough implementation that made it easy to manage the user's cache volumes, etc. We're also hoping to use Firecracker VMs in the near future.
I myself did try to run buildkit in a Lambda as I think that would be low cost option. But I found it you couldn't make gRPC calls against a lambda and that is a hard requirement for us.