Personally, I try to think of hosts as a website, and ask myself if a given building would have a website attached to it were it operating in the modern age. If it would, I give it a host. I usually think of hosts as coming in two types as well. One type includes those designed to ease the use of consumers or provide entertainment to them, such as social networking hosts or the host for your local library. Easy to get into, and your persona has an easy excuse for being there, even if you're up to something illegal. There are other hosts that are used to make it easier to sort and catalog data, as you might find in most corporate headquarters. These ones, in my game, have tighter security, and usually have a spider attached to them. When I use spiders, they are also responsible for managing the hosts' archives, so they're being paid to do more than sit around and wait for a hacker (as far as competence goes, for most runs I build them to be slightly below par to the PC hacker, but they've got IC on their side, and of course higher security areas have better spiders). There are other hosts that combine the two. A hospital, for example, has an open area that people use to check in on the status of friends or relatives in the hospital or to get general information about treatments, billing, or accommodations. Such a host would also have some areas that are protected and closed off to the public, mostly used to keep financial records and detailed patient information, or keep track of medical equipment.
Small operations I never give a host to, but that doesn't mean there's nothing for a hacker to do. Mom and pop shops might not have a host, but they will still have remote security cameras and other devices that either operate on autosofts or are slaved to the owner's commlink. For me, it's mostly a question of how much of a presence the place needs to have matrix wise, and how much security they expect to need for their data.