Fair, but you were asking how people approach security for self hosted solutions and I guess I’m challenging why anything needs to be public. Self hosting is typically for your own services which can usually be hidden behind a VPN.
The exception I guess is email, but I never understand why people attempt self hosted mail servers
Do websites come under the remit of self hosting?
Personally I host static websites with GitHub, cloudfront, netlify, onrender etc. Trivial to setup, more reliable and better cdn distribution. Anything dynamic lives in a data center rather than a self host setup.