No reason to connect jellyfin to any sort of local network, router will still hairpin for local connection.

With that setup its honestly more secure than 99% of IOT devices, and like 50% of routers.

edit: and if youre running it in the pentagon or something just toss authentication like keycloak in front of it, plus a bit of crowdsec/fail2ban and an IP whitelist, I'd be surprised if you'd even get an attack, much less one violating that strict of a threat models.