So they throw Cloudflare in front of it and get defaced yearly. I've worked for companies (thankfully not in a position dealing with the website) that did just that. Somehow they're even still around a decade later. To be fair though that was actually Bluehost, not a VPS.