You’re right in that its fully documented, but it seems your understanding differs from the documentation. Your provided link explicitly says, “Opening a port directly to the Internet is therefore insecure and not recommended.”

There’s a multitude of reasons any business with critically important data to their customers (lawyer, accountant, etc as you mention) should not roll their own system to save a couple hundred dollars a month…

Yup. You’ll need to insert your ID into the US govt approved router as well