Yea a lot of home admins aren't going to setup a DMZ with a different network range and firewalls. I need to do that myself for some of my servers, but I also don't host anything public from my house, and the only incoming connection allowed is wireguard.

I do have all my CCTV cameras on a different physical network which can't connect to the Internet, so .. that's a start.