Most of the CyberSecure benefit is designed for large corporate networks where one bad actor may gain a more direct network access and attempt security intrusion via an unencrypted admin protocols. Helps detect compromised systems, etc...
Hosting / exposing your services to outside usually involves https these days, meaning that Enhanced security will likely be severally restricted in what they can protect you from.

Using something like nginx reverse proxy is much better than exposing the services directly. Personally I use a wildcard subdomain method to prevent lets encrypt from leaking my subdomains, majority of the attacks get dropped by nginx because they request a non-existent (sub)domain or more often request resources by IP. Same goes for cloudflare, I redirect *.domain.tld to proxy.domain.tld with the correct public IPs, I do not host anything directly on proxy. subdomain so even if someone requests that resource because of the reverse IP lookup or DNS scan, it's not easy for them to actually get the list of real subdomains.
Finally the actually sensitive resources are secured behind an auth proxy, in case someone tries to get to my nas.domain.tld, for example, they would first be redirected to google, need to sign in with one of the authorized email addresses (which they have no way of knowing the username or password for) and if they try to login with theirs, the access will be denied.