I don’t really agree with you here. If you take the time to set things up properly. And prepare for IF something would happen. Your fine. Been running a exposed jellyfin server for years now. Never hat a security issue. And even if I would, not much harm could be done anyway due to how it is setup.

I don’t even need to use a VPN to be forced to login…

How difficult can it be to just give someone a login? I don’t get the whole sharing jellyfin is difficult argument. It is just as easy as any online service 🤷‍♂️

Kubernetes comes to mind for that