Yes. A hacker can change the content, including downloading code when a viewer requests to view a page, or redirecting a link to a page the hacker set up. If your website host has capabilities beyond serving static pages, a hacker can use these services to launch DDOS attacks, send junk email, etc.