Should I also forward port 8333 (for Bitcoin) to run a lightning node and get maximum exposure? Or just 9735 (lightning)?

I think this largely depends on how you define exposure. However, I don’t think the pattern you describe for lightning node scans makes sense. In addition to excluding nodes that do not expose port 8333, we also assume that both nodes are running on the same machine. It’s perfectly plausible to run it on another machine on the same network, or as another container in a dockerized setup.

So overall, I think exposing the Lightning port is enough.