It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.

Never in a million years would I do this

Short answer: No.

Long answer: Hell, no!

Why would you want to expose it to the web in the first place? In a homelab scenario, you’re the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.

I would never do something like that. It’s actually a sad story: I had a server that had to be exposed to the public, and not long ago, it was compromised by the latest PHP vulnerability. Fortunately, the damage wasn’t too severe. Since then, my policy has been to only expose services to the public that must be accessible to strangers, and I never expose administrative access points to the public internet. SSH access is restricted to key-based authentication, and the admin panel is accessible only from the internal network or via VPN. Two-factor authentication protects against password guessing, but it cannot prevent vulnerabilities that can be exploited before the login process even begins.

I guess that depends: are you okay with literally anyone accessing this computer? If so, change nothing.

If you’re trying to just give yourself access to your own computer, stop forwarding ports and download Tailscale.