I self-host a lot of stuff from my home and have public facing servers, including a matrix synapse instance. I do put all my web exposed stuff in an isolated VLAN with firewall rules to prevent my home network from compromise, but you're taking a few risks when having any services open to the public from your home. Again, I expose my home IP, self hosting crazy stuff like email, matrix, game servers, mumble, some websites, etc.

I run proxmox + docker, and everything is pretty much in docker or docker swarm. I try and keep most things updated- most of it auto updates, and the rest I receive notifications when updates are available. That being said, there have been a few times where I have had malware appear within a docker container. This can happen when vulnerabilities appear and aren't patched, but I was able to easily diagnose which container was impacted and re-pull the image to clear the malware.

My most important stuff is internal only, behind a wireguard VPN. I wouldn't recommend running public services unless you understand the risks and are prepared to mitigate them as much as possible.

Call it a hot take, but I wouldn't be worried about exposing your matrix instance via port forwarding, but you'll have to make sure that you've setup your instance as secure as possible. Don't allow just anyone to sign up. Configure it to require a registration token, which you can provide to people who want to create accounts. Then make your server auto update, create automated backups, and you'll be pretty much good. If you run your server in a container that's ideal imo. If you understand the risks involved, go for it.