I definitely don't open a bunch of ports to the internet! I use Wireguard to VPN back into my home network from my mobile devices. Wireguard only responds to packets that contain a valid preconfigured crypto key, so while the WG port is technically "open" it doesn't respond to a port scanner.