You're not wrong, but compromising a server that exposes nginx configured for static files, sshd, and nothing else is at least an order of mag or two harder. Probably no one is going to drop an nginx 0day on your blog.