I've seen some attackers get through multiple firewalls running different OSes that didn't have any open ports, just sayin'. There are techniques.

The main usefulness of a VPS is as a C&C server or phishing or mining.

The Scrap Value of a Hacked PC, Revisited:
https://krebsonsecurity.com/wp-conte...ckedPC2012.png