I'm using a Cloudflare tunnel to expose Home Assistant protected by Google Auth and use it anywhere from my personal devices.
Note that if you are not using Cloudflare Access as additional authentication layer and only rely on Home Assistant authentication, the Cloudflare tunnel obviously works with the Android app. It's just that I was too paranoid for this.
Maybe I'm overly cautious. Home Assistant does have two-factor as options as well, doesn't it?