A server does not wait to be famous before it gets attacked. The moment a public IP address starts answering, automated scanners already sweeping the entire IPv4 range find it, usually within minutes of the first boot. Nobody chose your box specifically. A script tried it because it tries everything, the same way it tried the address before yours and will try the one after.
This is the single fact that should shape every decision in this course: the overwhelming majority of real compromises are automated and opportunistic, not the work of a determined human targeting you by name. A bot does not care that your server is small, new, or unannounced. Obscurity, a low profile, a domain nobody has heard of, defends against nothing, because the scan does not look up who you are before it knocks.
That order is not arbitrary. Remote access comes first because it is the door everyone tries first. Exposure comes next because every open port is a door of its own. Patching closes holes that are already public knowledge. TLS protects traffic once the box itself is reasonably sound. Secrets hygiene and monitoring close out the list because they assume the earlier layers are already in place.
Before changing anything remote, keep a second way into the box open, typically the hosting provider's browser based console. It is the difference between a mistake you fix in seconds and a server you have to reinstall.