UPnP is fine if you know what you're doing. Again with proper firewalling. Plus 2021 malware does not use UPnP. They NAT punch anyway over 443 + HTTPS.