The most plausible attacker is, IMO, someone scanning the Internet en masse for 0day or 1day vulns that haven't been patched yet. Which not exposing it to the I

The most plausible attacker is, IMO, someone scanning the Internet en masse for 0day or 1day vulns that haven't been patched yet. Which not exposing it to the Internet prevents. Most (initial) attacks are not targeted at you, they're just scanning the whole Internet.