Direct inboud connections for a geth client (please not server, such a bad word ^^) is very rare and usually you must allow this behaviour with a proper configuration of your firewall, your home router, and so on, and in some cases you cannot achieve that without talking with your network administrator or even your ISP. Even with a classic cloud installation you will not have open inbound connections by default.
That said, as Mikhail Vladimirov already stated in the comments, hacking of a node can be done by just chatting with other nodes, regardless of who established the connection in the first place.
The reality is that you can't trust your client: you shouldn't trust it, you don't need to trust it and you cannot assume it's not compromised. Stick with these assumptions and build from there: don't store any secrets or private informations on clients, create more then one client to query and double check informations (i.e. one geth, one parity, installed in different infrastructures), and so on.
And if or when you think the client is compromised, just shut it down and create a brand new one somewhere else.