If you are port forwarding. I recommend not exposing it on the default port of 25565 and instead expose it as a random port. Then, assuming you have a domain name, create an SRV record that points to your IP and port. This will cut down on the drive by scanners who scan by ports, but won’t totally eliminate it. If you do use the SRV record, your friends won’t even notice there’s a different port.
Kind of but it’s not fair to put it all on the manager. Multiple people decided to hire the person. Somebody else approved that code review. People approved the technical design. Why didn’t the tech lead raise concerns with the manager about someone’s under-performance, etc. it’s unfair to just put all blame on the manager.
The idea of extreme ownership is about not saying “not my problem I won’t do anything” or blaming your reports. It’s about saying I can and should do anything and everything in my ability to fix problems.