If they find anything we fix it, update our services, and move on.

The chances of being hit by a zero-day as a random self-hoster are very small, but anyway if you keep backups and can restore a clean state (and patch your system) you should be good.

The goal is not to have perfect security, it’s to mitigate the risks and to handle fallout correctly.