There's still a bunch of outstanding API security issues last I checked, so it's not secure enough for me to open to the web.

Teaching friends and family to use it with a VPN is a whole another can. Also, you'll have to make sure the VPN is secure and users don't have access to the rest of your network...

and then you'll have to deal with client apps/access for mobile, android boxes, TVs, and Chromecasts...

I got lucky with the Plex Pass too so I can only ride this out to the end until Jellyfin catches up. (also, I'm not good to contribute code)