Yes, and it's not "general" it's "100%". Never ever expose this sort of thing to the general internet if you don't really know what you're doing and probably not even then in the present era. That sort of ancient and second-string codebase is just too big and complex an attack surface.

Eh. I'm skeptical "most users" are doing VNC sessions at all, the vast majority of non-technical people who do anything of that sort will be using shinier (and separately patched, and often better performing) 3rd party software like TeamViewer, or in more serious situations an IPKVM since Apple's remote access is really limited/mediocre. And even when it comes to VPNs, these days I think the "slightly advanced to quite advanced person" general advice would be to use a convenient service like Tailscale (which has a free basic tier even) unless you can/desire to dig into it further. But even self-hosted it's gotten more and more convenient, a lot of the prosumer types of that bent will probably be using something like Omada or UniFi, which have added native modern VPN support of their own.

"Don't enable screen sharing to the internet ever" is reasonable baseline advice IMO. Same as "don't expose IPMI/BMC to the internet ever" and so on for that matter. The threat there is just too high. If you absolutely need it and absolutely can't install a personal VPN find someone else to get you going on that. Because you'll be paying to deal with your hacked system otherwise, and probably a lot more.

Yeah this makes me think of people like my dad who are savvy enough to be torrenting etc. and wanting to VNC in to control it (which in the old days meant opening a port), but not enough to be up on the best way to do that today.

Luckily he has me I got him onto UniFi so now it’s all buttoned up and using Teleport.