I've had my VPS exposed to the internet for a while and never been pwned. No professional experience. Use SSH keys, not password authentication. Use FDE if physical access is in your threat model. Use a firewall to prevent connection on internal-only ports.

Vaultwarden will store your passwords encrypted (obviously) so even if your database does get stolen, the attacker shouldn't be able to read your passwords without your master password.