They're running on VMs, not bare metal, presumably, because their (new) server's reverse DNS is vps-*, and previously on Digitalocean. You can just dump the VM's memory space while unlocked, can't you?
A lot of this seems like security theater, especially while still hosted behind Cloudflare.
A lot of this seems like security theater, especially while still hosted behind Cloudflare.