Pretty much anything is vulnerable to a zero day exploit of some form or another. If you have data you wish to publish, or data that you wish to ingest in one direction only, a data diode might be helpful.

In this case, you manage the outside server, hardening it as best you can, and set up monitoring of bandwidth use, etc. through a network switch, etc.

The data diode will only pass data in your preferred direction, and can't leak it in the reverse direction.

In the case of inbound data only, you are protected against any data egress.

In the case of output data only, you are protected against ingress of control. You still have to watch for exploits pushing data out through the diode, but you can be sure any hack won't have been sourced from the internet.