Public access is what is in immediate danger. Private services are safe from bots, but at risk from attacker on your network - a compromised IoT device or package on server could move laterally to vulnerable PHP services