"And SSL is pointless on said site if it's for instance a Let's Encrypt." That isn't pointless SSL. Let's Encrypt isn't going to protect you from nation states

"And SSL is pointless on said site if it's for instance a Let's Encrypt." That isn't pointless SSL. Let's Encrypt isn't going to protect you from nation states, but cyber criminals aren't going to be invested or necessarily sophisticated enough to get Let's Encrypt's CA keys. Also, if you are worried someone will take over your Let's Encrypt automation and generate new certificates, they probably could use the same RCE to get at your private keys or directly sniff traffic from the compromised system. If you qualified this statement with "if the business is large cap", everyone would agree but then again that's why BigCo uses traditional CAs or roll their own.