Yep, tunneling is way more secure than direct p2p. Especially if you run the service inside some sort of sandbox/container/VM which is possible on all major OSes these days.