My first tech job was working alongside the network admin at a regional ISP. I feel like a n00b on the subject, but objectively, I'm pretty good at it. So basically, I've nerded out about it for years. I do allow VPN access to my LAN, but even that is tightly firewalled with a default-deny policy. Connecting to the VPN just lets you make connections into the LAN's address space, but only for certain IPs and ports. I can connect into Plex running on the LAN, and specific ports on the NAS. I can SSH into a Linux box that doesn't have credentials to connect to anything else. That's about it, really.

I didn't set out to make a hypersecure setup, but approached it with "least access" in mind. I started with the default-deny firewall, and when I needed an exception, I added that one single exception. Honestly, if you follow that principle — don't allow it if you don't require it — you've done 95% of the work a dedicated expert would do.