You still need to consider security even if there is nothing being sold.
If you are on a shared hosting account the host will look after the security of the server or at least they should. They are responsible for running anti-viruses, patching software and keeping up to date. You would be responsible for making sure your passwords are strong and files are
chmod correctly.
If you are running a dedicated server that would be a different story.