I would guess that we could just give an external company control over a kube master and have them run their operator, which in turn will spin up all the necessary pods and stuff.

You give a SSH certificate and you get back an IP address in your on-premises / cheap host with Kafka running along with monitors.