> The main thing that gives me anxiety about this is the security surface area associated with "managing" a whole OS— kernel, userland, all of it. Like did I get the firewall configured correctly, am I staying on top of the latest CVEs, etc.

I've had a VPS facing the Internet for over a decade. It's fine.

  $ $ ls -l /etc/protocols 
  -rw-r--r-- 1 root root 2932 Dec 30  2013 /etc/protocols

I would worry more about security problems in whatever application you're running on the operating system than I would the operating system.