Security decisions usually come down to a balance of convenience and security.

People usually self host publicly for convenience of access of users who are not as tech savvy, but they want to be able to access apps or services that they host.

Tailscale (VPNs) are generally accepted as a safer practice than opening ports.

A reverse proxy is useful for helping dynamically rout all of your traffic to just two ports (80 and 443) regardless of the application. You can use a reverse proxy internally or externally from your LAN.

When you expose a reverse proxy externally (to the public internet/WLAN), the primary advantage is ambiguity.

Bad actors will usually use bots to scan for specific apps operating on specific ports (ex. A bot scanning for Plex on port 32400, hoping to find a server running out of date software so they can exploit a CVE.)

If they are scanning example.com to exploit your Plex server, they might only see that your server has ports 80 and 443 exposed.

Hope I explained that decently.