I suppose this validates my strategy of exposing as little attack surface as possible. One SSH port with password auth disabled, one HTTPS port that greets you with an authentication request.

> In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.

I would advise anyone to not expose things meant for your local network to the internet unprotected, ever.