The problem on DO is not outside tradfic but insode. when you enable networking everyone in the same DC network can access open ports on your machines. That elastixsearxh or redis you use needs ssl and pw protection otherwise you have a big problem
Public network + firewall feels dirtier than private network, but in reality they are the same thing: a network that’s only accessible to your VMs, to the extent that you trust the provider’s software to enforce that boundary.