What I actually said is that it's a chore to run a small website, and that applies even to a simple static site (although you're right, way more if your site runs backend scripts). Bad actors are still going to try to DDoS you, attack your static webserver, and send you entitled emails.