Unfortunately, yeah.

Frankly at this point, everything that is not explicitly fully public should be...

not necessarily always a VPN, but you can also use a reverse proxy like caddy or nginx where encryption and security are primary concerns instead of something non-essential like in jellyfin.

I doubt that, how would that work? You would need to give all your friends a VPN login into your local network for all of their devices, including TVs.

or your friend can setup VPN on his Router box.

But then all of his traffic goes through my internet. Unless he has a special high end router that can only route specific domains.

You dont need high end box, a old mini pc running pfsense/opnsense is enough.

High end, as in feature rich.

If you think most non tech people can just casually find an old pc, install and setup pfsense, then you are out of touch with reality. And they also would have to let it run all the time and have space for it. That's just not something realistic. It's not an option for my friends. Might also break chromecast.

Most non tech people just subcribe to netflix/hbo/disney and call it a day.

Correct, most do. Still leaves a significant portion that does not want to sub to multiple streaming services. Be that as it may, I have multiple friends who I share my jellyfin with. Giving them all access to my network is just not an option. It's not.

Tailscale. Your friend just needs to be invited to your tailnet. Super easy to use with clients on all the major devices.

Even on TV? Without their other traffic is going through network? Also for non technical people?

Yes, I have Tailscale on my AppleTV. Only traffic attempting to reach your tailnet is routed to you, the rest is on his own network.

If you want to make it super easy for non technical people also use reverse proxies to your tailnet so jellyfin/plex is reachable at like “https://watch.example.com”. Pretty much the only friction for non technical people would be creating a tailscale account and being invited to tailnet I guess. But you could also just do that for them I suppose with auth keys

Their stance is actually that exposing it is fine

Reverse proxy works fine. There’s even a setting in Jellyfin to provide the proxy IP.