You are probably right. It is surprising that Miyagawa didn't incorporate something like this already and it makes me wonder what everyone else does when using Twiggy. Do they just run it as root and not care about the security aspects? Do they hide it on a high port behind a reverse proxy? Or do they offer it publicly but on a non-standard high port?

Thanks for thinking of and sharing this approach.