If it's a computer publicly visible on the internet then it has an attack surface, not having a scripting language enabled reduces it a lot but not entirely. There is still a web server involved in a static site being served, amongst other services that computers often have by default.
If it's shared hosting, still a problem, just not theirs.
If it's shared hosting, still a problem, just not theirs.