It can happen that your internal services are still reachable from externally, by calling the external IP and setting the Host header manually to sub.mylan.home, even if that were pointing to an internal address. Traefik would only compare the Host header. To secure this you might also add an IP filter for the internal host, but I‘m not sure whether that’d be secure enough.

Go read the first few chapters of the Bobiverse series. First book: „We are legion“ This will answer your question in spectacular ways.