To me WireGuard is safer than exposing services directly to the internet.

Sure, it's pretty simple. I had WG provided by an Deciso OPNsense router with an automatic VPN profile on most user devices. All of my infrastructure also had PKI. (I moved recently and have yet to set it up again.)

Tailscale is able to hole punch in scenarios where UPnP is disabled (just good practice) as well as many NAT environments.