I admin a smaller pubnix/tilde, for me I tie down email, inbound connections, some strict resource limits per user, and keep a close eye on anything running. I'm sure if I start getting more users it'll become more time consuming but with a decent logging and sensible security practices you could probably negate the vast majority of bad actors.