A proper witness server only has SSH exposed, even that can be blocked by a firewall. The likelihood of a witness being attacked is slim to none if done properly, but most witnesses are just running Hive in a Box and really don't know much more than following the 8 steps to get it up and running or securing their server(s).
I think the real threat being presented here, is a data center or service provider telling you the take a hike. This happened with SSD Nodes, they ninja changed their service policy and said no one can use crypto projects on their server and cancelled anyone running a witness or anything crypto related without refund or notice. I had 8 servers there at the time they shut a few of them down without warning or refund and referenced a Terms of Service change that was made without notice and said it was my responsibility to read their terms of service daily.
Yes, the data center threat is political not technical.
While its obviously important to have some witnesses with a high level of technical skill able to help with hard forks, having lots of HIAB witnesses running their own equipment mitigates the political threat of Big Tech censorship.
Hive shouldn't be doing any hard forks at a time that it is under political attack. As the system matures hard forks should be much rarer than they have been in the past.