I've had a dedicated server running my (personal) web site, mail, and a variety of other services, directly connected to the public internet, with no firewall, for five years.

My domain is #95k in alexa, #69k in Compete and #35k in Quantcast. Just to say, while it's no heavy hitting destination site, it's not just a tiny personal site either.

I've never been hacked. I just don't set up insecure services.