Is APIM Standard_V2 tier viable option from security standpoint if you have Developer portal enabled

From my understanding with APIM Standard_v2 tier you can only configure the gateway endpoint with private endpoint and have that behind something like application gateway to allow the ability to have WAF in front of it. But, the developer portal is reachable only over its public address and cannot have private endpoint.

Even after adding a custom domain on the Developer portal endpoint, the default <name>.developer.azure-api.net address keeps responding and returns 200.

If you set all your APIs to require approval for subscription , then for a production scenario where you would allow "Try this operation" functionality on your APIs through developer portal, is it safe to still use standard_v2 tier. Or are there some security problems associated with that?