Wasn’t intending to come off condescending. IMO exposing your internal network to the internet without a proper firewall is a risk, one I wouldn’t take unless I had a DMZ and a dedicated VLAN.
In addition, you’d have to be on top of patch management. And when you do that, there’s a chance of something breaking too. My preference is not to have to muck around troubleshooting my own email server when a patch window goes bad since that’s what I deal with all day anyway. There will always be zero days, I’ll just pawn that off the the big boys.