If any service has only username and password instead of mfa or password less then it’s not safe.

You also didn’t mention if you have automated patching or immutable backups enabled.