I'm on your side. I don't really see the difference hosting Jellyfin or Plex to the internet.

If you want max security and headache for jellyfin, set up a VPN like they say, otherwise keep it exposed, It's very unlikely for your server to be targeted and It hasn't been worth the hassle for me.

Edit: well not directly directly, do the minimum and put it behind a reverse proxy that adds HTTPS of course, but thats recommended in the docs so yah