There aren't any operating systems capable of withstanding the internet for a year without updates and/or active management. Until this becomes possible, and widespread, the idea of self-hosting is going to remain niche. Furthermore, because no browser is totally secure, users are going to avoid non-popular links, perpetuating the walled gardens they already use. I fear our monoculture of operating systems has to be…
I’d wager >95% of LTS linux distributions released in the past ten years are still rock-solid if you’re just exposing 22, 80, and 443. Even PHP5 is still de facto bulletproof if you’re paranoid about not trusting user input.
Vulns don’t come out of nowhere.