The only reason to expose it raw to the internet is because your hosting a piracy service.

You can easily keep everything inside of a wireguard VPN and expose nothing directly.