There are different degrees of "exposed to the internet." You don't need to make your self-hosted services fully accessible by anyone from everywhere. VPN, IP whitelists, mTLS, HTTP basic auth, etc. change the calculus of security and feature updates. You can afford to lag a bit behind on updates because you're not running critical enterprise infrastructure at scale.

Pretty much every home router, network firewall, and host-based firewall is set to deny all by default, so the effort is mostly needed to allow exposure to the Internet.

You can put them behind wireguard and still have all this without exposing it