I still don't get it. The alternative would be for all OSes to run services X,Y and Z even if you install it in order to host service W. Also, you would then b

I still don't get it. The alternative would be for all OSes to run services X,Y and Z even if you install it in order to host service W. Also, you would then be "happy" to get remote rooted on your W service box, when attackers found an exploit in Y, just so that the box was not "empty" of services? Even if you meant to run service X or Z, it would still be "better" to have the exploitable Y running by default, just so the system wasn't bare or so that they could not have that line on the webpage? If you don't want to get exploited by default when you put your box on the internet, and these people have a method to get you there AND others tried running all fancy services exposed and did get hacked within minutes after putting such a box on the internet, would you still say "not exposing your box immediately" is a bad idea? Is it cheating somehow to not participate in the race to the bottom?