Any safe easy way to forward SSH securely?

Most people here don't forward SSH at all, because of security risks (botnets will hack your device in minutes edit: without proper security). But I'm wondering if there's an easy way to setup it securely. So far, I'm using password authentication on my home network, but I really really need to access my production machine during the day because I'm always on the go, far away from my lab and generally only have my phone or a random Windows machine (they're still handy for remote access because of the built in SSH client)

So far, there's all there options, but do I really need all of them? That's... a lot, and only the bare minimum according to some. Is any of these overkill?

• Setup SSH on some port that's not 22 (security by obscurity)
• no password auth
• no root login
• VPN
• Something like fail2ban
• 2FA

Anything else I missed?