May I ask what do you guys have exposed to the internet?
I personally just have a wireguard VPN (single UDP port open) and everything is accessible through an internal reverse proxy. I just never felt the need to expose nothing ant least not web related.