SME does what it does out of the Box and is secure.
But as you say you have opened SSH up to whole Internet and if you have not got a Strong password then you will be hacked and if you have not kept up2date with the ssh versions this also would be true.
Search on here on how to secure even more when using SSH set to internet