Limits and timeouts were added to Kestrel in 2.0 that enable it to be supported for use as an Internet facing web server (we made that announcement then too). Reverse proxies are still advised for defense in depth of course.