While your setup stays the same, major security flaws are found in different parts of the stacks.
Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.
Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense
Security is a state of mind, indeed.
* Inject a cryptocurrency miner JavaScript into your page during the transmission of your static HTML page to your clients, without you or your users knowing it [1]
* Injecting explicit, illegal image material that would get your clients immediately in legal trouble for possession of such material, without you knowing
* Injecting a JS snippet that, instead of your site's contents, shows a fake antivirus page, telling the clients that your site is malicious and that a threat was eliminated by Fake Antivirus 10.0 and that they should immediately call Microsoft Support (Phone number in Bangladesh) for further "assistance". There they're told they need to get a full cleaning of the hard drive for only 99$ and are asked for their CC number
The point is: If you don't have end-to-end-encryption, you can never be sure what your users see. They might see your site - or some slightly modified version of your site, with a login box, phishing passwords from your users, abusing their trust in your brand.
A MITM has nothing to do with someone gaining access to your server. It's someone gaining access to infrastructure - a vulnerable public wifi, for instance.
[1] https://www.hacking.reviews/2018/01/coffeeminer-collaborativ...
Anyway, if someone can manage to access my servers with only nginx serving static files, they deserve to 0wn it :-)