a static site is served by a webserver, but the software to generate it runs elsewhere.

Yes. And a web server has an attack surface, no?