Yes, but the alternative is far worse. I present America as Exhibit A.

I’ve got mine on a subdomain through a Cloudflare tunnel that points to my local nginx proxy manager (with wildcard SSL certs) then to immich. You can do access control through Cloudflare as well. Quite low risk in my opinion as long as you protect it properly.

Looks like that one isn’t maintained. That page links to this one instead.