Tunnel to your home network from the VPS using a VPN like Wireguard
The suggestion should be slightly different: Tunnel FROM your home network TO the VPS using a VPN. Note the difference: the tunnel is initiated from inside the home network, not from outside.
This means no port forwarding is needed into the home network - which greatly reduces the attack surface. Also the tunnel is fully under control from the home network and can be simply stopped if there is a problem with the VPS like a potential compromise. And if the VPS is compromised no credentials could be leaked which would allow an attacker to build its own tunnel into your network.
Even better than a VPN would be an application based tunnel, which by design limits access to the application from the VPN instead to the whole system.
If an application listening to that port is insecure, the attack surface is the same, whether its ingress is an open port or a Wireguard tunnel.
It is true that a VPN tunnel by itself does not protect against attacks to the application. But the reverse proxy on the VPS in front of the tunnel can do, like requiring additional authentication, implementing a WAF ... Of course, such protection could also be implemented internally directly in front of the internal application.
But a simple port forwarding has another problem - contrary to a VPN (or even better application-based tunnel) from the internal server machine to the external VPS, a port forwarding exposes any internal system/application which happens to run on the given IP:port. This might have been the specific application at the time the port forwarding was created, but it is simpel to change internal things over time and forget that there was some port forwarding from the outside - thus potentially exposing a different application to the internet.
