I have it on reverse proxy to the world with libraries mounted read only

There's no risk in doing this.

(I am invoking Cunningham's Law)

I think it's Netbird with their reverse proxy feature.

https://docs.netbird.io/manage/reverse-proxy

Netbird is like Tailscale, but Open Source. You don't have to self-host, but you can. They have a reverse proxy feature that let's you easily expose a device to the Internet. You can set basic authentication on the service, like requiring a password to access the page or only allowing certain IPs to access the page.

I use this with my parents. I got tired of the Tailscale app on the Google TV constantly shutting down. With the reverse proxy, there's no more VPN app. My service is publicly accessible, but protected by an IP allow list.

My parents have an Apple TV so I installed the Tailscale app (which they never have to touch) and Jellyfin (or Swiftfin, I can’t remember) and it’s fairly smooth for them.

Tailscale or another Wireguard/VPN is the safest, but requires your users to have devices that support it.

Easiest is reverse proxy with domain and open ports, but your risk tolerance decides if that is viable or not I guess.

My users know that it’s Tailscale-able devices only or nothing, and that works fine.

I’d say spin it up and play with it. If it’s a lot of hassle, then stick with Plex for a little longer. It’s still a very good program, even if they are moving away from what they used to be.