Meltdown/Spectre kind of vulnerability plus injecting Javascript to anything that is http only by rouge ISP employee or user on open rouge wifi. It is not about targeted attacks it is about low hanging fruit which any http site is and bots, automated hacking/injecting.

Like people saying that changing SSH port on your VPS is not security. Setup one Linux VPS and see how many bots are trying to brute force your password. Just change the port so they stop trying.