Keep stuff that’s not designed to be exposed to the internet on your LAN behind your router’s firewall.

Use a VPN to access your LAN remotely. Tailscale is the easiest way to do this, but I found it not too hard to set up WireGuard.