Note that tech news is biased towards flashy or relatable security issues. Nobody is going to n-day your phone (though you should, of course, keep it up to date). It's your Drupal you should worry about.
But those tend to be against journalists and activists.
What threat model you operate under is a nontrivial problem.