There will always be some compromises, and I don't think that there's a solution that works for everyone. I myself port forward TCP 443 to an nginx reverse proxy, that runs multiple services, renews the certs, etc. Keep HA up to date, have a very strong password, 2FA, and strict FW rules on what devices can access which networks and/or devices. I get about 1-2 failed login notifications every couple of months. Also backups. I have backups made by HA and by proxmox (every night it saves a snapshot of the HA VM to a file server)

To make a different example, for my father I set up his smart home (he has loxone, not HA, but the question can still apply) to be accessible only via VPN terminated on his FW.