Apart from being unintentionally DDOS if the DNS server is found and
being used but botnets etc., what is the risk of doing that? I guess
some people scanning the web may eventually find that DNS server and
use it for some (bad) reasons, but in the end is my LAN at risk?
Any open port increases the attack surface, in theory. Your LAN could be at risk if a serious vulnerability is found in whatever DNS software you use.
The biggest risk is that your DNS server becomes an unwitting participant in DNS amplification attacks. Your home connection could also be flooded with bad traffic and become unavailable due to saturation.
To minimize abuse you could also set up rate limiting (RRL). Here is for example how it is implemented in Bind.
What I usually do for a private DNS service is to configure the resolver (eg Unbound) so that it only listens to a local interface (tun0), that is used by OpenVPN. So it is only visible to VPN clients and not open to the whole Internet.
So the best solution is to use a VPN. You've said this is not convenient in all situations, then something you could do is set up port knocking. This is security by obscurity but seems sufficient to me in this scenario. Here is an example that explains the concept. But since you have a router this will require opening a few ports (those required by the knocking sequence you'll define).
Now correct me if I'm wrong, but I had a look at the doc for Pihole and I have the impression that the built-in DNS 'server' is dnsmasq, so it is only a forwarder that sends requests to upstream servers like Google or OpenDNS. Then this is not a real resolver like Bind or Unbound and the benefit is not so obvious.
However they explain how to use Pi-hole with Unbound: Setting up Pi-hole as a recursive DNS server solution
