Love Tailscale, I love that I can be sat in my office on a completely different network and connect to any hub or 3D printer like I'm at home, just brilliant.
So you have 65,535 available ports with a tcp/ip connection. Typical is 80 (http) 53 (DNS) 443 (https) etc. Some people who do not know what they are doing will open a port on their router/firewall and tell it anything coming in for lets say port 8080 goes to my local network 192.168.1.150. The problem with this is that now you have a live open port that can be easily exploited and allow anyone on the internet to get to your local network. This is bad. The safest way to connect to your home network is via VPN (and I always recommend certificate based) This way nothing is exposed and no one can see the traffic going over that VPN.
100% this. With easy-to-use tools like Tailscale, there's zero reason for anyone to use port forwarding these days.
I think Hubitat’s position has always been that port forwarding is an inherently insecure way to access the hub from the internet.
IIRC they took the step of making it harder to reach the hub that way by default (though I believe it’s still possible with undocumented hub endpoints for those that understand and can appropriately mitigate the risks) after some hubs were found to be accessible over the internet and didn’t even use login security to prevent unauthorized access.
The problem with Homey’s approach, as I see it, is that it may have the effect of encouraging some of their users to make use of port forwarding without really understanding why it’s risky, how to secure such a connection, and what the alternatives are.
Of course that’s not their intent, but Homey’s meant for home users (just like Hubitat), which means many users won’t have enough IP networking experience or professional credentials to even recognize that they could be compromising their hub or even their entire LAN’s protection against threats from the internet.
Admittedly I haven’t looked at Homey’s marketing or documentation materials on the topic for myself, just going by what’s been shared in this thread.
Since port forwarding happens on the router, one can't literally disallow it on the appliance, so I suppose you mean the hub validates the source address.
The important concept here is the direction in which connections are established.
A simplified explanation: typically, devices on your LAN establish a connection with something on the internet. Port forwarding is really just a technical term for allowing the connection to be initiated in the other direction, i.e. something on the internet can initiate and establish a connection to something on your LAN. It's risky, unless you know what you're doing and the target application being forwarded to is designed for that use case (e.g. a VPN solution).
When using Hubitat's cloud dashboard links or Remote Admin, it appears as though you are connecting to your hub from outside your LAN, but under the hood, it really happens the other way: when the hub boots it creates a connection to HE's cloud infra and that connection is leveraged for everything your hub exposes to the internet.
Three hubs?! What do you have and how much are you asking?
You're right not everything is available via matter/thread but most is. All my bulbs are Thread(well almost - Aqara) . I have almost dropped zwave completely except for power clamps. I will end up with just zigbee and Matter/thread. I am running Homey SHS - that's on my old windows server. i paid life license .. I bought a Homey Bridge for aerials but have subsequently reverted (eat humble pie here) back to running one HE with only zigbee active. devices(rock solid). Homey updated the zigbee code and broke everything then i discovered it only support 30 devices so i went back to HE using maker API.
You gotta be crazy to put ANYTHING from LG in your house, especially after the Gamers Nexus videos about LG hardware. Homey is owned by LG. I would only recommend Homey to my personal enemies.
There is no single perfect home automation hub. Most of us run a mix of hubs to meet our automation needs. I personally use:
Hubitat for z-wave and 95% of automations
Apple Home for geofencing and a mobile app
Home Assistant for zigbee devices
Nothing wrong with having Homey in that mix. I tried Homey SHS for a bit and found it didn't provide anything that I didn't have already.
A few weeks ago, this wouldn't have been quite so bad. But after that video, I am not sure I would get near anything LG or support their shady business practices.
Unless you don't mind your information is being sold or given to any and everyone. I know they all do it, but LG seems very egregious in how they have done this.
Those videos are compelling. I watched several of them before yanking the Ethernet cable from my LG OLED TV.
Oh great. Not sure I'll be yanking the Ethernet from my 84" class LG TV though.
I did. 
Mine is restricted to LAN access. Actually, it sits in a VLAN.
I really had no need for mine to be on the network at all, other than maybe firmware updates. I don't use any of the smart features. So for me it was an easy / no-pain decision.
I stream to mine sometimes from my MacBook. So it has to stay on the network. But I have to say - the Gamer Nexus videos were eye opening.
Yes, that was my thinking, or realization, after watching the video. My TV is ten years old and it has been years since I used any apps on it; it's just an HDMI display. Any firmware updates it wants to do at this point are almost certainly not to my benefit.
I'd expect mostly maybe some T&C's updates that makes everything they are doing "properly disclosed." 
TCL likely does the same thing. I've always hated the google tv interface, so we just added Roku's back to our tv's and didn't set up anything for google tv (including network access). Anything Roku itself gets black holed (which blocks a lot of ads). And the physical units are on their own vlan.
I’m lazy so haven’t disconnected either of my LG TVs from Ethernet but I did add them to a local-only firewall rule I have for untrustworthy IoT devices.