Ten years ago I was asked about security on my self hosted personal server and said "It needs to be good enough to stop the script kiddies and automated scanners, if somebody with enough ressources thinks my website is worth
a targeted attack, I probably don't have a chance anyways."

Now the script kiddies can just spend enough tokens to deploy targeted attacks on a large scale. Great.