3. You're connected to many nodes and open ports which add security vulnerability
This was the one question I had as well but if I'm running my node through something like a router that doesn't broadcast my private IP address I was told that's fine
Everyone you are communicating with on the internet (e.g. websites, microsoft server, games server, basically whatever you do with your PC which has to do with the internet) has your IP (or at least he IP of your ISP if you are sitting behind a NAT).
This has no security implications at all.
In fact, it is necessary. An IP address is absolutely NO private information. It is absolutely mandatory to communicate.
Therefore each node you are connected to, sees your IP.
If you additionally accept incoming connections, they are connecting to your PC (on port 8333).
As long as there is no severe vulnerability in bitcoin core, that's completely fine.
Theoretically, a chance exists that a specifically crafted message can crash core, for example.
Or, which would be the ultimate MCA, a remote code execution with the permissions of the user running core.
The attack surface exists.
The theoretical chance of such a vulnerability also exists. But since core has been here since the beginning of BTC, it gets less and less probable each day.
Core is a properly tested software. Not some student-project.
I, personally, would assess the risk as being low or very low.
If you are using windows, you shouldn't be worried about THAT at all. Windows has way more vulnerabilities which are way more severe than bitcoin core will ever have. And most of them stay unfixed for a long period of time.
