To be fair it's pretty much the norm with shared and even vps hosting that your cpanel etc will be publicly accessible. Only people who hand-roll their setups will have things firewalled down etc. And if it's a website promoting a local tree planting initiative or whatever is it really a good use of budget to get everything hardened so much.

And if it's a website promoting a local tree planting initiative or whatever is it really a good use of budget to get everything hardened so much.

Given the fact lots of sites like that have Wordpress 'databases' of form submissions full of people's personal data, absolutely definitely emphatically yes.