Monero's proof of work (RandomX) is very asic-resistant and although it generates a very small amount of earnings, if you exploit a vulnerability like this with thousands or tens of thousands of nodes, it can add up (8 modern cores 24/7 on Monero would be in the 10-20c/day per node range). OPs Vps probably generated about $1 for those script kiddies.
So $40 a year? Does that imply all monero is mined like this because it's clearly not cost effective at all to mine legitimately?
Hit 1000 servers and it starts adding up. Especially if you live somewhere with a low cost of living.