You aren't wrong but the things you're mentioned are always an issue, even if he was running the entire website on a VPS.
VPS happily tries to forward 1Gbits, fully saturating your home ISP line. Now you’re knocked offline.
Yeah, but at the same time any VPS provider worth it will have some kind os firewalling in place and block a DDoS like that one. People usually don't ever notice this but big providers actually have those measures in place and do block DDoS attacks without their customers ever noticing. If they didn't hackers would just overrun a few IPs and take all the bandwidth the provider has and take their all their customers down that way.
I'm not saying anyone should actually rely only on the VPS provider ability to block such things but it's still there.
The OP should obviously take a good read at nftables rate limiting options and fail2ban. This should be implemented both at the VPS and his home server to help mitigate potential DDoS attacks.
Say someone abuses a remote code execution bug from the application you’re hosting in order to create a reverse shell to get into your system, this complex stack introduced doesn’t protect that.
It doesn't and it was never supposed to mitigate that as the OP only asked for a way to reverse proxy / hide is real IP.