@KI5SMN
True enough. Mine's hosted at wordpress.com where updates & security are not my problem, it's theirs.

And we don't know much about the security knowledge of various people hosting various Mastodon instances, either. I'm sure there are ignorant, insecure ways to do that, too.