That’s the thing, the only thing I have open to the Internet is a port forwarded SSH with non-root key authentication, into an up-to-date Debian stable. The logs show no attempts. The odds of someone breaking into public key OpenSSH and getting root, with daily security updates, are rather slim IMHO. The router is also an attack surface but it runs up to date OpenWRT.