It's not about susceptibility, it's about actuality. When you open your home page, do you see an army of bots or an army of non-bots? That's what matters.
There isn't an infinite pool of bots out there seeking to get into anything they can. There are like, at most twenty bot actors and they're focused on the most lucrative targets.
Remember when the entire car insurance phone spam in the USA turned out to just be one guy with an army of proxies. There are surprisingly few people at the top of the worldwide spam operations.
Isn't that because they are aiming for the biggest targets. Anything that became similarly successful would be similarly targeted.
Being small enough that malicious actors are not interested in you is beneficial, but by definition it is a solution that cannot be widely adopted.