Wireguard is pretty much secure as any connection that is not authenticated is immediately dropped. If you open port 51820 only, then I think that's okay. Pretty much if you use distro wg, then just keep it up to date. I don't know any 0-day vuln for wireguard yet, so just be cautious and monitor logs.

Buy a Banana PI R3 or NanoPi as the RPi does not have enough lan ports, almost same spec

Wireguard its default, and already part of of kernel just needs proper config and config tools