I have it listen on a loopback interface and do SSH port forwarding when I want to look at the stats. Nginx proxying with basic auth is a perfectly reasonable approach and not a workaround in my humble opinion. I would trust these two approaches more than an unknown mechanism in Netdata.