To reduce that, there are a few things you can do.

Option 1:

• Only open port 443 and run everything through a reverse proxy like traefik. You can open other ports ad you need them (game server for example)

• Run crowdsec to get rid of 95% of bad actors

• Whitelist IPs that you know traffic will be coming from and drop everything else

Option 2:

• wireguard VPN and just VPN into your home network to access your server

Option 3:

• Run tailscale

• run fail2ban

Absolutely a fair reason to be nervous. For this just follow the rules of minimum access. Only open the ports you need to open, and make sure they only point to the item you want to expose. That will take care of 99% of use cases. Most hacks you see happening right now with home labs are because someone did something pretty obvious - like exposing their router/firewall UI to the open internet (instead of it only being accessible to the local network), same with their data servers.

If you have a good network you can even restrict which IPs are allowed to connect through those ports, but remember if your mom's IP changes or you're sitting in a hotel then you're essentially blocking yourself out (without a VPN or something).

Finally, and I would save this for a little later, you can move your Emby/external services to an alternate VLAN. VLANs are virtual-lans, they are a block of IPs that have firewall rules in between each of them. So you could do rules like "Internal clients can talk to Emby, but Emby cannot talk to Internal Clients". This can be a daunting thing and will take a lot of trial and error, not to mention probably revamping your entire network - so I'd hold off for now.