This is a bit over my own head as I’ve only been dabbling with it recently, but so far from what I’ve found that seems to be the case.

You can get creative with the Rules, but that’s always accepting a level of risk. Like to get Beszel and Komodo Periphery working on my VPS, I technically expose some services, but I keep Pangolin’s auth enabled and use the rules to restrict it to certain paths and only my own public IP (1. Allow: my IP, 2. Always deny 0.0.0.0/0).