

There are ~50,000-60,000+ available IP ports. If you had Wireguard configured correctly and running on every single one of them a port scanner would get exactly the same result as if every port was closed. Wireguard is completely silent unless the correct key is provided.
The “script kiddies” could scan every port for months and they’d get the same result. There is no known way to even know there’s an open port much less know that Wireguard is running on it AND have the correct key for access.
I understand being gun shy after your experience (I would be too), but that experience has nothing to do with what happens when you open a port for Wireguard.

I’ve been using Linux for years, but on my hardware I’ve never been able to get Ubuntu to work reliably. I now only use it when booting from a USB for backups, but even on a relatively recent Dell laptop with Intel graphics the GUI crashes constantly. IMO it isn’t worth the trouble, but of course someone here will be oh-so offended by that.
After trying dozens of distros I went back to Mint because it just works.