Ideally the traffic would be siphoned thru a load balancer/reverse proxy of some kind rather than the dest service endpoint/port being directly exposed to the internet

Sure. But everyone else here was talking about servers. Which, you know,... serve. Are in some way on the internet.