Cloudflared tunnels are great. No firewall ports to open.
I installed the Cloudflared docker, which is headless, and fed it my API key. Then Cloudflared creates a VPN between your system and theirs. Then, think of Cloudflare as the reverse proxy, you just configure it on the CF site instead of locally. No need for a reverse proxy on your side.
I've not done anything with auth on it as what I run I don't mind being public. If you still want to run a local auth, you can set it to hit your local reverse proxy instead and do it that way.
The benefits are you don't need to open firewall ports and your local IP is irrelevant so no need for dynamic DNS.
Meh, it's sorta 6 of one and half-dozen of another. The benefit of not opening ports on a firewall isn't necessarily a security one so much of a convenience one for people who don't know how their routers work or no access to open those ports. The only security value is it prevents any exploits on your router and a port scan against your network won't show those ports open. That makes it easier to hide the fact that your hosting something. I'd agree, it's not a huge security vector to worry about, but can help people not see your real IP which has tangible value.
Really, your offloading security to CF and putting trust in them to do a better job than you, but as you said, in doing so they can sort of get the keys to your kingdom. I think it's just worth it with their other tools to block bots and other common exploits that a Netgear home router isn't looking for.
The problem with a vps and tailscale is its one more thing to manage and a vps costs money and cf is free.