Until your VPS provider has its management dashboard breached, allowing an attacker remote console and configuration access to your VMs and everything that enables.

I dunno why you're getting downvoted, they don't even need their control plane breached, it could be a neighbouring VM running something out of date and an attacker getting out to the hypervisor and taking your disk images without you or the hosting company ever knowing.