15-20 years ago you could get away with more mistakes without them biting you, but they where none the less mistakes that where bad.

These days the bad actors have automated there exploit attempts to the point that its not even really about asking when you will get hit rather then if you will get hit anymore, its almost instant in most cases.

with so little leeway its just not viable to self host anything that is exposed to the internet, and then if you still have to deal with things like off-site backups if you care at all about your data.