I’d agree with you on the surface, except for the part where virtually every single comment on Lemmy about Jellyfin’s remote access basically boils down to “lol just tell them to use Tailscale. It works fine for me ¯\_(ツ)_/¯”. Again, I’m talking about the average user.

And it’s not about being a paranoid nutter. Jellyfin has had multiple exploits in the past. Hell, it had a code execution vulnerability from unsanitized FFmpeg API inputs published just last week.