I had it open for a web server for 2.5 years because I was lazy and my IP changed a lot and I traveled and didn’t have a VPN setup and never had any issues as far as I could tell. Disabled password and root auth but was also fine with wiping that server if there were issues. It’s certainly not recommended but isn’t immediately always going to be an issue
Kibana/ES is overkill and not worth it. I have Loki, promtail and grafana setup for my 4 VMs and 2 systems. Took about a week to get dashboards and stuff going (plus geoip and worldmap plugin config for my public servers) but haven’t had to touch them in about 2 years since.