The typical guides for installing Jellyfin and friends, stop at the point where you can access the service, expecting you to secure it further.

Turns out, the default configuration for many (most) routers, is to allow external access to anything a local service will request it to allow, expecting you to secure it further.

Leaving it like that, is an explosive combo, which many users never intended to set up, but have nonetheless.