What could be the issue with exposing WireGuard at a random port to the public internet?
It works over UDP so it doesn't even send any acknowledgement or error response to unauthenticated or non-handshake packets.
There may not be an issue at all, I'm just gun shy about opening any ports publicly. I don't do networking often and have never focused on it enough to feel confident in my setup and maintenance.
The main reason I haven't jumped into hosting wireguard rather than using Tailscale is mainly because I reach for Tailscale to avoid exposing my home server to the public internet.