Much is mentioned in the Node-RED forum about exposing Node-RED to the Internet. This flow is an example that provides a reasonable amount of security for most casual use.
It makes use of a cloud service called NGROK and you will need to sign up for an account. NGROK is run by a commercial organisation and you have to put some level of trust in them that they aren't intercepting data though it seems unlikely. The service is widely used and would almost certainly be exposed if they were doing anything egregious.
The default configuration of ngrok isn't that secure so I did some playing and came up with a flow that turns the ngrok link on/off via a secure Telegram bot. That way, you only turn on the link when you actually need it.
You need to use a slightly more complex command than the default to get ngrok reasonably secure:
http https://localhost:1880 -bind-tls=true -auth='jk:jk' -inspect=false -region=eu