They do scan and try all ports.

I have a tiny VPS as reverse proxy with SSL termination for my fiddling. That one has a wireguard network to my hardware at home to which it forwards some hosts.

The tiny VPS is definitely the bottleneck in the equation, and if I were to have loads of traffic I’d probably go with cloudflare or -front in front of it.