A good mental model to have is AWS Lambda or other "serverless" cloud functions - you don't have to worry about the setup and security of the host server itself because it isn't the server itself you care about, it's the result of a particular run of code or data access that you're concerned with. The hardware is slightly abstracted away.

The short answer for both of you for the moment: most security risks are about unwanted access or OS vulnerabilities.

For the latter, the flippant answer is "our OS will just not have vulnerabilities". That sounds like a bullshit answer, but our entire stack from the kernel to userspace has a very contained footprint, no dependencies on external code or libraries, our compiler binaries are human readable so nowhere for exploits to hide, and the privileges/access of any additional applications you install will be transparent to the OS and auditable by you. When you have typed, pure functional programming up and down the whole stack, deterministic guarantees like that are feasible.

Re: unwanted access: Our OS should be thought of like a VM. So either a slightly technical person takes the most rudimentary steps to insure a host machine they fully control has access control handled (this isn't that hard. SSH settings + firewall); or a totally non-technical person has a hosting provider (or friend or family member!) handle that detail for them on mamaged hardware.

Kind of vague response for now, but as the weeks and months roll on we'll have more authoritative technical documentation to link to in place of my blathering.