I mean, assuming you run the server for this app on the same LAN as your CalDAV server, you don't have to directly expose it to the internet.

That said, my Radicale server is exposed to the internet, and I haven't had any issues. The *DAV protocols are mostly just HTTPS requests with Basic Auth.