I have 50/50 speed so that's ok.
And having a single open port in my firewall won't do much. I'm trying to think of a scenario that is not secure. If the Minecraft service itself is hacked, then tailscale or Cloudflare tunnels won't help me, because they will probably gain the same access rights as the user that I created for the server. Or am I missing something?
Weird TCP packets ? I probably receive those already, server or not.
I'm renting hardware, so if it breaks I probably get the same hardware (and I am assuming backups will be on me). Yeah that is a valid consideration. It will cost me at least several days to find replacement hardware.