Yeah, this was roughly my experience too when I ran a little Pi server for fun. If you check the access logs you’ll see a bunch of automated low-effort bot attempts at directory traversal and the like. But nothing serious.

Generally there has to be an ROI for someone to really want to go after you.

I had a note on there that said something to the effect of:

   If you think you can hack this server, you probably can!  Please don't. I've invited you into my home for tea; please don't break my dishes to show me why I should've kept them in a safe.