I agree, there is a lot of paranoia, but honestly that’s probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.

The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there’s a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don’t recommend not reading up on anything and exposing server, etc. Just for me, I don’t need to over do it).

That being said, personally I have ssh behind a vpn because that’s a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.