Anecdotal security risks of exposing JF to internet

[abpjf]

My public JF server is totally drop-trou on the interwebs, plain http. I basically don't care who can "break into" it (as in, not my authorized users) since it's on a segregated machine on a separate network from my personal network. What can they do? Delete media? Eh, got nightly backups of everything in the unlikely event that occurs. Lift my users' data? Eh, I create their (admittedly both as ridiculous as possible) usernames and passwords, so who cares what malefactors do with that? Take down the server altogether? Meh, can easily spool up the duplicate in essentially no time.

TLDR - it's simply not important enough for / to me to waste my time implementing the "secure" measures.