Most of "basic security practice" assume that software does not have or have very few, hard-to-discover bugs.

For Ex, the best practice is to use VPN, so you only open port for VPN, and you assume whatever VPN protocol/software does not have any bugs.

You can use tailscale so you dont have to open port, but after all, tailscale is also software.