I upvoted you, and yes, cleartext NFS is a concern.

I had it wrapped in stunnel TLS, but I ripped that out recently as I am retiring and the new staff is simply not capable of maintaining that configuration.

My users were yelling, and the patch to tinysshd to omit all permissions checks silenced the complaints. No, it's not pretty.