You are getting some pushback but you are not wrong. I thought I was being pretty careful with my DO droplet but just last weekend discovered that it had been hacked and was consorting with mysterious IP addresses in Russia and Brazil.

This was on a box that was firewalled and ssh was locked down. It was running an older kernel - that was probably my downfall.

I immediately shut down and rebuilt the droplet with a more modern kernel. It wasn't too hard because my site is (mostly) static with a simple custom service but is very discouraging to find that somebody has damaged your home project just to (I assume) make a small amount of money.