(And "Go host a high-volume-spike blog at ___ like a normal person, and then solve the other problem" is entirely valid and welcome)
If you need a place where you can out several websites that don't make money for a sustainable, reasonable small cost, you'll be surprised by the price/quality/performance offered by good, independent cPanel based hosting providers these days.
By independent, I mean not owned by GoDaddy or Newfold Digital (formerly Endurance International Group, EIG). Just as an example, Bluehost, Hostgator etc are owned by Newfold Digital, with big brand recognition and subpar service.
cPanel isn't aesthetically pleasing, but it keeps the market outside the big names extremely competitive. You can ask another cPanel based host to migrate your accounts at any time in a process that's standardized and quick.
With NVMe disks and software built especially for the hosting industry, such as CloudLinux and LiteSpeed, these hosting options can be very performant. On CloudLinux, all hosting accounts run in their own containers with RAM and CPU limits so the system as a whole stays responsive. These environments can easily feel as snappy or better then self-configured virtual machines.
I tried out A2Hosting's Turbo hosting early this year. The performance was very good, but their EU datacenter had connectivity issues.
I now use a British company called Stablepoint, run by people who used to operate TSOHost before selling out to GoDaddy. Stablepoint uses public cloud infrastructure, so the reliability is very good for very reasonable prices around numerous data center regions globally.
I do use Stablepoint's highest-end reseller account, so I can't speak for the performance of their regular servers. A2 is probably very solid network wise in the States, and their non-reseller Turbo plans are affordable and very well regarded. Both companies have generous 2-4 GB RAM limits per cPanel account on their mid-tier accounts.
Oh, and I got good support who quickly figured out a db issue that a custom plugin was having and got us a solution. Turned around in 1.5 business days. And we weren't on a super expensive plan.
For personal sites or ones that do not matter that much:
* Digital Ocean
* Amazon Lightsail
For sites related to your livelihood or that matter a good bit:
* AWS works well for me.
That said, both services have firewall rules you put in place that help manage this. IE - you may expose SSH to your local ip address, but only port 80/443 for the rest of the world.
You are right though - its another attack vector. If you don't want to muck with that, and you have a static site, you could put your static site into S3 and then host with cloudfront. With that, you have no risk.
It essentially provides the power and flexibility of a cloud VM with the convenience and "set-it-and-forget-it" nature of shared hosting.
For those who don't know, Cloudways is essentially a management service that runs on top of a cloud VM of your choosing (choices include DO, Vultr, Linode, AWS, GC). For a premium over the cost of the VM, they take care of all the provisioning and config for you, while still providing a powerful platform (allows SSH access, etc) and some added functionality (Git hooks, staging sites, credential management, and more out-of-the-box). It's really quite slick.
The default Cloudways Wordpress stack performs very well. Their caching solution is built on Varnish, controlled by a competent plugin. However, I do find that some themes and site builder themes simply don't play well with at least Cloudways' Varnish conf, so one might end up using the included memcached or redis for page caching, with the help of some plugin like W3 Total Cache.
Customer support can be hit-or-miss.
I wouldn't necessarily recommend using Cloudways' lower tier plans, and Cloudways doesn't recommend them for production use either. I pay about USD 100 per month for a server on Digital Ocean that hosts sites I maintain with a web agency. We rely on Cloudways' development tools. For the number of sites we host, it's a very appealing price compared to certain big-name Wordpress hosting companies.
For someone just wanting to host one or more small websites for a sustainable, low cost, I would recommend looking into well regarded cPanel hosts that runs CloudLinux and LiteSpeed on NVMe hardware. These companies also have some very decent, standardized Wordpress management features these days, even though the cPanel GUI us far from pretty. I describe this in more detail here https://news.ycombinator.com/item?id=32255962
Siteground had a "move my WordPress site" plugin that worked much smoother than I expected.