There are constant scanners on any site and scrapers on websites, but it is far less of a problem than you would imagine unless you have a big wiki or software forge with hundreds of nested commit history pages for them to spider into.

I also run private servers on hidden subdomains (with wildcard certs and DNS entries), so the low effort scanners never bother them.

DDOS attacks take money, so they aren't typically going to go after some random homelabber. If it did happen, I would either just shut it off for a while or change the VPs IP. Ovh also has some of its own ddos protection.