depending what is on it, and your risk factor, theoretically an attacker can check known resource paths to confirm or deny whats on the server. That's my main complaint currently on it is that the jellyfin team is aware of the fact that it doesn't need authentication, but are looking for some miracle solution that won't toss legacy clients out in order to fix, so therefore the issues are just perpetually open.

edit: it looks like some of these issues may be being worked on now that they moved the problemic protocal into a plugin. I hope that that means they will close them in the next few releases!

So far. That you know of.

I'm on your side. I don't really see the difference hosting Jellyfin or Plex to the internet.

If you want max security and headache for jellyfin, set up a VPN like they say, otherwise keep it exposed, It's very unlikely for your server to be targeted and It hasn't been worth the hassle for me.

Edit: well not directly directly, do the minimum and put it behind a reverse proxy that adds HTTPS of course, but thats recommended in the docs so yah