Comment by pferde
That's not a fair criticism. Of course you need to expose the server to the network clients are going to be connecting from. Whether that is Internet or just a LAN, that's orthogonal to the protocol.
I've also had an intra-company Matrix server running completely on a company internal LAN, with no Internet access, so there is no inherent need for it to be on The Internet.
Yes but even for a web service the attack surface is pretty big. Lots of obscure URLs and the code isn't that clean either.