I am self-hosting my email. It's a pain in the ass, but software like mox[1] help on keeping things easier.
The most tedious part is to setup correctly SPF, DKIM and DMARC and ensure that your IP will be whitelisted.
replies(2):
For SSH access, I have fail2ban + access only via certificates. For the rest, I have disabled web access and APIs as I don't need them.
I also keep an eye on logs, but there is not too much there, besides some bots scanning for open relays