If they aren’t critical to the business, have a blast with it. But when the downed services prevent or distract from the invoiceable work, that is a problem.

Will you have an infra team to support these apps? If the answer is no, I would self host anything business critical.

This TPLink switch has been pretty much invisible for my setup, using 5 of the 8 ports. https://www.tp-link.com/us/business-networking/managed-switch/tl-sx3008f/

Have it be accessible over Tailscale (or similar) and that alleviates a lot of the access concerns. No need to setup port forwarding either.