TL;DR: It depends on the deployment and on who dictates consensus on the blockchain. If it's the provider then, yes, the provider is a single point of failure (assuming a non-diverse deployment). If users participate in the consensus algorithm then, with some care, the provider could be trusted with only storage and availability.
Your question
[...] concept of "blockchain as a service" [...] where apparently there is no need for miners: so does this mean that the technology provider just became a replacement trusted third party
This depends on how the users of this blockchain reach agreement on it. If users simply trust the "blockchain as a service" provider to dictate consensus on what the blockchain is, then, yes, the provider is the only trusted 3rd party.
However, if users take part in the consensus protocol, voting on what the current valid blockchain is by verifying transactions, executing smart contracts and so on, then not necessarily. The provider can merely be trusted with availability and storage while 2f+1 users out of the total 3f+1 users are trusted to vote correctly on what the valid blockchain is (see [6]). There are various design points that could be explored.
In this last case, however, the blockchain provider or someone else has to be trusted for admission control: who is allowed to vote on what the current valid blockchain is? Someone has to let people in and out. And if they're not careful, it's very easy to attack the system: just add a bunch of fake extra voters that swing the election your way (see [7]).
Put another way, if you're not going to mine (i.e., do proof-of-work/stake/etc.), then you can't defeat "fake voter" attacks (see [7]), so your system needs to be permissioned: it needs a trusted party that does admission control.
[...] if so what prevents them from being a weak (hackable) link which would undermine the whole purpose?
Assuming the blockchain provider dictates consensus, not much. Unless a "blockchain as a service" deployment spans multiple administrative domains (e.g., clouds from 5 different continents) it will be easier to undermine.
By the way, if we stop and think, then the whole "blockchain as a service" philosophy is self-defeating: it gets us farther away from a blockchain like Bitcoin, not closer. Consider this: From a security perspective, why do we need a provider of a "blockchain service" anyway? If it's gonna dictate consensus on the blockchain, then it's a trusted third party. And if it's not going to, then we don't need it to begin with: we can just replicate the blockchain and agree on it ourselves.
The answer, I suspect, has to do with all the hype around "blockchain." Everybody wants one, missing the bigger point: we're all supposed to share one (for security), not have our own.
Nitpicking your assumptions
One of the key tenets of Blockchain technology is that it is a trustless, distributed ledger [...]
Regardless of what "blockchain technology" means nowadays, it's misleading to call it a trustless distributed ledger. In Bitcoin, Ethereum and z.cash, for example, users like me and you have to trust many things:
- That miners are actually incentivized to only mine on the longest chain (see [1] and [2]).
- That both the overlay network (P2P) and the underlying network (the Internet) between miners is reliable: it delivers blocks on time (see [3] and [4]).
- That attackers are not rich enough to reverse your transactions by adversarially mining. Or, that your transactions are not worth it (see [5]).
- That there are no other errors in the design: e.g., what happens with z.cash's security when miners jump from mining one cryptocurrency to another compatible one as they deem it profitable?
- That there are no bugs in the code.
...and much more.
[...] removes the need for a trusted (but hackable) third party to oversee the veracity of transactions (e.g. a bank).
Sure, there's no single trusted 3rd party. In Bitcoin there are around 20 now (or, however many big mining pools Bitcoin has, assuming they don't collude). Maybe z.cash and Ethereum are more decentralized due to their memory-hard proof-of-work, but it remains to be seen how long that will last.
Also, because there is no single (or distributed) trusted 3rd party, the network now plays a critical role in the system's security [3, 4].
[...] no-one being able to control all (or even a significant number of) the miners in the network, thus rendering the system as secure.
GHash.IO controlled over 50% at some point in the summer of 2014. Once again, it remains to be seen whether a single entity or multiple colluding entities can (again!) control more than 50% of the computational power in the network.
References
