Depends what 'home server' means.

MacOS would need syncookies to be a viable tcp server on public IPs, IMHO, but MacOS pulled FreeBSD's TCP stack a couple months before syncookies were added, and they never rebased or otherwise added syncookies later.

I haven't looked into if they pulled any scalability updates over the years, but I kind of assume they haven't, and the stack would have a lot of lock contention if you had more than say 10,000 tcp sockets.

Given that, if I were Apple compatible, I might run a mini as a LAN server, but my home servers provide services for the LAN as well as some public services (of limited value and usefulness, but still public).

The network stack is very different now - BSD doesn't run on cell phones after all. But no syncookies, no.

But IMO the real advantage of ARMv8 for a server is that it has better security.

I don't really think ARMv8 has anything useful to provide here?

It's all in there, it's just optional.

Plus it doesn't have variable length instructions.

I'm still not entirely sure what the security improvements are?

Perhaps they would be good execution nodes if not good endpoints.

Is this something that you can fix by putting the server behind Cloudflare? I assume most "home server" users would do that (or a similar service provided by Apple if they go down that route).

Well, Cloudflare is kind of spendy if you want them to proxy non-http traffic.

If you put a proxy in front, and you're careful to only allow inbound connections from the proxy, you should be ok though.