Is it safe to expose host ports directly to containers in production?

I’ve seen tutorials that map host ports straight into a container with -p 8080:80. In a production setting, does this create security or stability risks, and are there better patterns for exposing services?