How does Blockchain as a Service (BaaS) work?
Who runs the nodes?

It depends on the type of Blockchain network you referring to. Typically it is permissionless or permissioned. For the permissionless; anyone/ any organization can volunteer to run full nodes as long as they ready to allow spare computing and bandwidth resources. No incentive Nor reward for this service. In future respective Blockchain company /developers - they may consider for incentive/s or rewards. This would ensure  more and more nodes running at a given point in time. More nodes means more secure for the block mining and there by your secure transaction/s. In recent past, there has been significant drop in "running full nodes". This is a bit of concern.

In addition, permissionless P2P network no access control is needed. Ex. bitcoin/ ethereum supports X.509 certificates and SSL encryption to verify receivers’ identity and help prevent man-in-the-middle attacks. Besides, Blockchain security validate each new block and follow protocol proof-of-work/stake which guarding against the bad actors.