Broke 14 months on my unraid server before rebooting for an update. But it’s been running 24/7 for about 6 years now with maybe 3-4 reboots.

Not bad practice just not as secure.

You can’t beat the security of not exposing it but sometimes you need to so then you need to mitigate it with certs, reverse proxy or VPN.

It depends on what you need and what your thread model is.