Earlier quoted context omitted.
I can only speak for tilde.fun, but it's helpful to not have any users currently (^^) and disable outside communication apart from ~/html/ where our users can put static files into. Most tilde sites don't have public mail servers and only federate mail between them and other tilde servers. See also https://tilde.team/ .
Do you use a VPS on AWS or something like that, or an actual physical box?
Since I'm paying out of my own pocket I currently don't want to afford a colocated server, even though I realise that'd be cooler and possibly more secure.
I'll try to have a detailed cost overview online somewhere soon-ish.