Hasn't changed much. I have accepted the risk and, for now, the desire to have publicly accessible stuff outweights my lack of desire to deal with the realities of a VPN. I mean, I want to share stuff with others, and I want to be hosting it myself because I have grown to distrust someone else's service... so what else can I do but risk it?
Besides: I expect tailscale or the underlying VPN services to already be a target. I would be surprised if they don't find anything. What then?