Small-business Linux servers should keep administration private by default. Public services belong on public URLs; admin tools, dashboards, SSH, and database panels usually belong behind a private access layer.
The practical risk
A small team may not have a security team, but exposed services are still scanned automatically. The safer starting point is to inventory what is public, decide what should be private, and move admin access behind Tailscale, WireGuard, SSH tunneling, or identity-aware access.
Start here
Read the full Secure Remote Access for a Linux Server hub for the decision model and supporting guides.