I’m pretty sure the word your looking for is managed VPS hosting. It’s available by many providers, but the cost increases significantly, depending mostly on the level of management included. On the security bit, if a client doesn’t mention a want for ssh keys, I automatically setup fail2ban without a second thought. There really does need to be a minimum level of security regardless of what is being served. Having simple passwords is something I wouldn’t even want to touch. If the client wouldn’t approve of switching to a complex password or ssh keys, I’d have to decline doing any work on the machine.