I’ve had a server running without whitelist because a friend hadn’t bought the game yet, within 2 weeks it was griefed. It was just the two of us playing.

There are crawler bots just searching for unprotected Minecraft servers and it’s just a matter of time before they find yours.