Like any CMS, it has a seemingly constant low level of patching to be applied. The more third party modules and themes you have, the worse that gets.
Remove unused modules that aren’t core. Same with themes. That’ll make things easier.
Otherwise it’s overheads are just Apache/nginx, MySQL/MariaDb, and maintenance of the TLS certificate, plus OS patching. All fairly well understood stuff that you should have no issues with.