Much of this risk is mitigated by hiding everything behind Wireguard or similar. None of my self-hosted stuff is publicly exposed but I can reach it from anywhere. You can go one step further and run some kind of gateway OS (e.g. opnSense) on a separate cheap VPS, route everything through that, then firewall your main server off completely.