The average user isn't using Jellyfin

All you need is a little Linux knowledge in order to setup Netbird with Caddy

If you have the skills to setup a Jellyfin server you also have the skills to setup wireguard.

My parents just got fiber and they don't even have a public address (ipv4 or v6) which just adds another layer of headache. thanks west virginia...

That's a very specific use case.

I'd much rather deal with setting up a few VPN gateways which is trivial at most...than securing a public web service. I deal with that crap enough at work.

There are a lot less variables to contend with with a single VPN endpoint which undergoes considerably more security auditing than N public web services. Many of which I don't have the time to review myself and mitigate if they decide to suck at coding.

Edit: I share my services with less than 5 households though.

Edit2: I'm not sure what public ipv4 or ipv6 has to do with this. My remote sites use starlink ipv4. I haven't setup ipv6 on those internally at all. They all tunnel via wireguard to my homesite.

that's fair, does it not have any kind of encryption by default?

I run pretty much all my stuff through NPMplus. Then I have a firewall between my public and private networks in case something does get compromised. But I've had Plex exposed (on a non-default port) for literally years and nothing ever happens.

Plex has its own set of problems

There has been a known “anyone can access your media without authentication” vulnerability for seven years and counting, and the Jellyfin devs have openly stated that they have no intentions of fixing it. Because fixing it would require completely divesting from the Enby branch that the entire program is built upon. And they never plan on refactoring that entire thing, so they never plan on fixing the vulnerabilities.

The “don’t expose it to the internet” people aren’t just screaming at clouds. Jellyfin is objectively insecure, and shouldn’t be exposed.