If you use a publicly trusted TLS certificate (either directly, or via Nabu Casa offering), domain will be recorded in Certificate Transparency logs.

You can slightly hide it if you use a wildcard domain in the TLS certificate (e.g. *.example.com), and then use a subdomain for the service. Ideally, something that's not home/hass/ha.example.com, or otherwise easily guessable.

Because there are a limited number of IPv4 addresses and bots scan them for open ports.

Nabu Casa offers a reverse proxy through their own services. I run mine this way. Haven't really had any problems with it in the year I've been subscribed.

Haha heck no, at least not in my case. It's not impossible to just stumble on the domain. An infinite monkey sorta thing.