That's very lame to say. The incentives of hackers to hack you and compromise your system is very very low. You don't represent any interest to them. So having just blocked port 22 and disabled ICMP can do the task to detract a big chunk of the automated attacks.

On the other hand commercial services are very high profile hacking targets and the attack vectors are a lot more sophisticated. Plus if you have a company, you need also to allow your employees to be able to work and you need to give them certain privileges to access the data they need. And guess what, not everyone is super careful and people make mistakes.

Once you start building stuff, you inevitably introduce bugs and dependencies, the bigger the project, the bigger the dependencies and patching all of them becomes harder and more time consuming.

Big corporations like MS, Google, Apple, etc. are having extremely strict and restrictive policies, including a huge cyber security engineers teams, and this is extremely expensive, especially for smaller companies, who are more focused on their product.

So please don't think that these companies are run by idiots but a single human mistake can lead to this compromise. And sorry to disappoint you but you aren't a cyber security guru either. Just hackers don't care about you which saves your ass.