I had it exposed for maybe ten years (mostly so that users could manage their accounts), nothing bass happened, but i have shut down that server about a year before the ai security disaster, so ymmv