Unless I am too tired and reading it wrong.

Rule 10: only white listed bots permitted.
Rule 14: no bots allowed.

Seems redundant. Rule 10 could be replaced with the new one.

I would have assumed that fell under rule 10 but the link 404s.

OK, but if your threat landscape is someone burning 2 zero days (one tail scale, one webmin) you aren’t likely to be posting here for answers you will have security people on call.

Geofencing is always a good option for remote access, no point in allowing someone from Spain to login when you are in Germany.

It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.

I would like to see someone compare it against On-Prem Exchange, for no reason other then it’s stupid to compare.

How do you check?

I hate it, but understand why they put it in multiplayer games.

Data centres only employ half a dozen people when operating. They can’t stop us all.