Comment by nodesocket

The main problem is DigitalOcean does not offer a centralized firewall, so they assume users will and can setup iptables. If they had a centralized firewall and default policy of all inbound traffic blocked and then you specifically open ports on droplets it would make a huge difference.