Also, I’ve got an email about any freshly imaged Mac Mini from Hetzner. Turns out macOS runs with legacy netbios ports open to the wide world by default, but to disable that service, you have to unload a service via Terminal. There’s no prefpane for that.