Yeah, that is a risk, but it’s a pretty reasonable one to take. VPN is good but certainly not ideal for some self hosted services.

If Immich, or Jellyfin, have all 0 day exploit that allows remote access to the network, a lot of folks will be freaking out, including me.