Not sure who JJ Luna is, but reading through his FAQ on ghost addresses doesn't exactly inspire confidence. Specifically his description of INTERPOL "holding someone's feet to the fire". That's not how INTERPOL even remotely works. They aren't a Supra national police org, they don't even have the power to make arrests. They are a data clearing house for individual state police authorities. At most they could put out some kind of notice, but it would be the Spanish police org in his example that would be doing all the work.
Understanding your adversary is the first step to rational risk assessment.
There is a free (but not open source) edition and it's been available for some time. SQL Server Express. It has very severe limitations though, which make it difficult to recommend.
Depends on the use case. A local POS vendor is running most of their local databases in stores (1..10 registers) on the Express version. Not sure how often they archive data out of the main database, though.
Several years ago I worked at a hosting company that was compromised via external and internal actor. The external actor used a vulnerability of WHMCS (one of many available, at the time).
To this date, the breaches were not disclosed publicly.
Tim's posts are truly book worthy.