You can use WP2Static and either run a container locally with something like https://lokl.dev https://lokl.dev, or spin up a VM that's firewalled off and access

You can use WP2Static and either run a container locally with something like https://lokl.dev https://lokl.dev, or spin up a VM that's firewalled off and access it through an SSH tunnel. The auto-on/-off part really does little for security, it's the firewalling that does the trick. Turning it off is good to save costs though. I'm actually working on basically exactly what you described (using WP2Static), and we're planning for a competitive $10-15/mo price, but we're not quite ready for launch yet.