Why would a VPN be less secure? It's an extra hurdle for attackers to take. You can still use whatever authentication you can on the service. And with a mesh VPN you also don't need to open any ports.

However when I look into it it seems like WARP is also a vpn-like service, just a cloud one. Also, I do self-hosting so a "cloud native" solution as cloudflare calls it is explicitly not what I want. If your homelab is all about cloud then of course you would want something like this.

My concern was specifically about other devices on the same home network, outside the homelab, becoming vulnerable.

I don't remember the details. Not relevant to you if you don't want to use cloud-native services.

Personally, I like proprietary security-oriented code where possible, cloud-native or not. That factored into the decision.

[delayed]