It's all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).

There's also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.