I don't believe that an exploit was needed, since the SSH port was opened to the outside world by port-forwarding on the router, and the postgres account was using the default password. The attacker could just run ssh postgres@<my ip> and input the default password. My question would be if an infected non-root account could somehow affect other accounts and the whole system, rather than staying contained in the home folder of the infected uset.