“The lesson here seems to be to expose the absolute bare minimum to the public internet.”
Bots hammer every public IP for .env files, AWS keys and .git/config. Shellshock is ten years old and still gets probed four seconds at a time. The Mirai payload ships in 13 architectures because router vendors never patch. The attacker pays nothing for the scan. You pay when you leave one file in the web root.