Its been a long time since I played, wouldn’t the best protection from that just be not broadcasting the server to the open internet? Never had an issue with servers that were technically fully open but only telling friends about it. I suppose whitelist is better than security through obscurity though.
It has been a long time since I ran MC servers, you could do all of that with self hosting though. I still remember around 2011 running a server at school with a PC we found in a skip. Glorious 750MB of RAM! It ran alright though for a room full of people.