Hi!
I often read suggestions to use something like Tailscale to create a tunnel between a home server and a VPS because it is allegedly safer than opening a port for WireGuard (WG) or Nginx on my router and connecting to my home network that way.
However, if my VPS is compromised, wouldn’t the attacker still be able to access my local network? How does using an extra layer (the VPS) make it safer?
Yes, and to be fair the OP doesn’t even need to expose a port on his home network. He can do the opposite and have the port exposed on the VPS and have the local router / server connect to the VPS endpoint instead. This will also remove the issues caused by having dynamic IPs at home as well.
And that’s a different animal (moving the goalposts, which is an excellent idea, but OP didn’t even think of doing this).
OP asked about exposing a local port, which is a Bad Idea 99.9% of the time, especially for someone asking why it’s a risk.
Using a VPS with reverse proxy is an excellent approach to adding a layer between the real resource and the public internet.