Same concern here. Also not just hacking the box, but if they figure out your service's ip it's the same as all your other stuff. Would ipv6 help this? Each device gets a different ip so there shouldn't be correlation, but could people make assumptions about ipv6 prefixes to discover other hosts on your network?

Is separate physical hosts a real improvement in security? It seems like a real air gap vs relying on linux hardening. Lots of raspberry pis (something cheaper now?) vs one larger home server hosting multiple services.

My consumer router has a dmz mode, but I'm not sure how far I can trust it. I guess it's a good thing nobody uses any of the stuff I host.