Ya, certainly a concern when going from well-funded org with hired experts to just yourself.

For myself, I just run automated security updates (uptime is not a pinnacle concern for me), do the basic fail2ban set-up, ensure I have a bit of reporting. Most importantly, I pray to Cthulhu I'm enough of a low-priority target that all I need to fend off is drive-by attacks.

I try as much as possible to isolate e.g. credentials and sensitive information from public infrastructure. Everything else that is more sensitive I stick behind tailscale, usually hosted at home on Pis or my NAS.