I've hosted stuff at home for almost 30 years, never bothered with a WAF. I have several VMs exposed with public IPs. If you keep your OS updated, it's hardly the end of the world. Sure, if you put up an unpatched OS from 10 years ago, you're going to have problems.