If any service has only username and password instead of mfa or password less then it’s not safe.

None of them do

You also didn’t mention if you have automated patching or immutable backups enabled.

I do not. I don’t even know what those are tbh