> I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need).

I find it helpful to have standard low cost (certainly no monetary cost, but also little in the way of bureaucratical cost) solutions which remove the need.

E.G.

"I need to access this device's webpage from everywhere"

"Fine, go via this proxy which has oidc integration with our corporate identity, Here's the URL, let me know if there's any problems"

Doesn't always work, but it certainly reduces the fights.