One thing that makes me feel a lot more confident about exposing a WireGuard port is it’s completely invisible unless you have the host’s public key. Nothing will show up on a port scan.

Its security model doesn’t rely on that fact of course, but it’s the cherry on top.