"Should" and "shouldn't" are dependent on context. In this case, that somewhat depends on what the router you're using is, how much you trust it, and your ISP's configuration. Opening a port isn't an inherently insecure thing, it's a choice that you make while being aware of the tradeoffs between that port being exposed to the internet at large and wanting a given service to be available.

What's the advantage of adding a VPS to the mix?

Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

This is frankly a bit nonsensical. "In a workplace setting, connecting to your residential IP will raise suspicions or alarms." - so will connecting to literally any unexpected VPN endpoint if the network is halfway competently monitored.

Just because your VPN endpoint is on a VPS somewhere rather than a computer on your home network doesn't make it any more secure, and the scare mongering here that somehow a home router will drastically mess up a function as simple as forwarding traffic coming in on a port to another machine is weird... if you don't trust it to do that then I'd get rid of the thing because that's its entire job.