Just took on a freelance joomla project where the last "dev" was charging $400 a month to admin the site. There was no security installed and the administrator directory was not redirected. It appears to have been brute forced about 2 years ago as I've found FilesMan back doors everywhere. It's good I'm charging hourly as I'm looking at a full rebuild now.