I've been using Jellyfin for about... five years, maybe? And it would never have occurred to me to put it on the open Web. I'd never bothered to check, but I'd just assumed it was a security catastrophe, like nearly all home-user-targeted itch-scratching software is.