You don't put these devices on the public internet! You use Wireguard to control access. Think Tailscale or similar.