Can I expose webserver, SSH, WireGuard to the internet with reasonable safety?

Yes, yes, and yes. Though in all three cases, you would want to have some sort of filtering and IPS in place, like fail2ban or similar, at an absolute minimum. There are port scanners of all kinds scanning for vulnerable software that can be exploited. Some people suggest changing the port numbers away from the default, and while security through obscurity can be a valid tactic, it alone is not a layer of your security onion.

A reverse proxy plus tunnel is a reasonable default recommendation because it is easy and prevents a large class of low-effort attacks and exploits, but tunneling has its drawbacks such as adding a component that exists outside of your direct control. It is also not a panacea. Reverse proxying alone is also workable, as it means just one point of entry to reinforce with logging and blocking.

But I feel like if I cant open a port to the internet to host a webserver then the internet is no longer a free place and we're cooked.

The Internet is still (for now) a free place, but just like with free speech, effort must be expended to keep it free. The threats have increased and while other simpler options have arisen to fill demand for self hosting, this endeavor is about investing sufficient time and effort to keep it going.

In my estimation, it is no different then tending to a garden in the face of rising environmental calamities. You can and should do it, so long as you're fully informed about the effort required.