Regarding the "Requires federation" section, that is not true. I've been running a small family-only homeserver for several years now, and had federation disabled on it from the very beginning, and there have been exactly zero issues related to (lack of) federation with it.
Same here, though you do still have to expose it to the internet unless you use a VPN. I'd prefer something with less of an attack service especially because bridges don't currently encrypt, but I host behind vpn now.