Every single one of my "internet facing" devices is blocked from accessing the internet at the router. If I want to access them they either get added to my HomeAssistant instance or another computer that's only accessible from the outside through my VPN.
All of the convenience with the privacy concerns practically eliminated. It costs $6 a month in hosting for the VPS I set the wireguard server up on.