And so, instead of having an open port for ssh, (ideally) with certificate-only authentication, optionally MFA, you trade it for an open port for tailscale/wireguard, handing over "all" your data to a company who is offering you a service for no monetary compensation.
Also, why do you think that it is better to not change the root password? It sounds like a very suspicious recommendation.
Also, why do you think that it is better to not change the root password? It sounds like a very suspicious recommendation.