I actually had a DO instance hacked, via Wordpress exploit. I guess I wasn't keeping my Wordpress up to date, or not running a security plugin I didn't know I needed. Had to shut the whole thing down, start up a new droplet, reload the website from backup.

Meanwhile my WP sites on DreamHost are happily humming along, automatically upgraded, any problems are promptly attended to by their support team. $12/month, unlimited sites/storage/bandwidth. I do not work for DreamHost.