Correct. If you make something outside of a local network, you have to place it inside a VPN for now. Otherwise, everyone will know you have access to it.
OR, you can use NIP-42 to authenticate with your public keys to write and read from the relay.
Discussion
You can also use something like tailscale or wireguard