Port forwarding does selectively expose a port in the router firewall, but it’s only vulnerable to attack if one of the following is true:
your Roon credentials are insecure or compromised (unlikely with MFA)
you’ve misconfigured port forwarding or another routing setting (DMZ, firewall settings, etc).
your RoonServer and/or network software is out of date
If you’re concerned about security risks, you can default to Tailscale instead, which is a Wireguard-based solution for NAT traversal that won’t require any port forwarding: