Security through obscurity is not sufficient. It’s also not nothing.

Immich released it’s first “stable” version. They mean to have fewer breaking changes and prioritize compatibility.

https://immich.app/blog/v2.0.0-release

I highly recommend.

If it’s just wireguard on a nonstandard port, then you are pretty much done. It’s UDP and won’t reply to incorrectly signed packets so it’s essentially invisible.