Method of authentication doesn’t matter if there’s a pre-authentication vulnerability: thehackernews.com/…/openssh-releases-patch-for-ne…

Instead of exposing multiple services, I would recommend just one VPN for remote access. Less attack surface.