This is why it’s important to have other security monitoring resources on your network if you intend to open ports or expose your services to the Internet. Also a good time to change all your passwords if you have not already.

Is there a reason you cannot accomplish this with a selfhosted VPN?

Exposing anything has risk. Risk of loss of data, your systems being used for other attacks, and loss of time/money to fix. It is entirety possible to do this as safe as practical of course- keeping your stuff up to date and having some kind of visibility into intrusion detection for immediate response are ways to minimize issues.

I’d use a VPN and give your friends the credentials for access to your server(s)