open source software getting backdoored by nefarious committers is not an indictment on closed source software in any way. this was discovered by a microsoft employee due to its effect on cpu usage and its introduction of faults in valgrind, neither of which required the source to discover.

the only thing this proves is that you should never fully trust any external dependencies.

no, and that’s be a pretty bad idea, you’re opening up all your internal hosts to the public internet.

a VPN is specifically designed to keep all your internal hosts off the public internet. When you authenticate with the VPN server the remote device you are using effectively “joins” the internal network, using the VPN to act like a tunnel between you and your network.

it has the benefits of better security as well as the fact that once you set it up, you can access any services you host, not just HTTP ones.