The worst I had was a credential-stuffer bot that used a set of leaked credentials to get on my mail server and send spam. I changed the password within 5 minutes and it stopped. That was the end of it.

Once I had someone deface a website because wordpress wasn’t patched. I just restored the site from backup and moved on with life.

I would think that most of the time, you just join a botnet.

BUT someone getting into your email can let them do password resets to all your accounts. Then again, I self-host my email because all mail providers are reading your email by default. I’d still rather self-host it.