My experience with most hosters, especially shared hosting, is they don’t have anywhere close to the latest version of software. Which isn’t necessarily a bad thing (if it’s not broke . . .), it’s just they’ll run a much older version that might contain a/some backported security patch(es) at the most dependant on the release schedule of the distro maintainer.
You don’t have anything like WordFence or any of the number of security plugins installed, do you?