> It needs updates. Critically, it needs security. You need to secure the ports and services, use vpn, etc.

It seems like you are doing this wrong. Unattended-upgrades takes care of updates. The ports need not be "secured." Some need to be open if you are running publicly facing services like email, there is no way around it, and it's not a security problem per se. Internal services should be behind a VPN, but that is a one-time setup cost, and one that a cloud solution would also face.