Hi,
I have read most of these and secured WP as best I can before the sites were hacked.
I don’t know if it was a server exploit or WP exploit as I use a VPS and only have 3 WP sites on there.
I have tried a few more security fixes on 2 of the WP sites, and left one as it is. SO I guess that if/when it happens again if it affects all 3 sites it will be a server issue.