> It is a public facing SaaS API which does not have much traffic in terms of requests, but would be catastrophic to be blackholed. So its that bad?

Well, depends on whether you have people that don't like you. For them it can be rather easy to stage a DDoS against your server and take that server offline for some time.

> Regarding hardware failures- have never experienced any so far, but guess it's just a question of when then.

It has been happening to me much less often since they switched most of their portfolio over to "Enterprise Grade" disks. These days I tend to go with NVMe anyway so it has become less of an issue.