Yeah, but the user is also inept, so it evens out.

Honestly though, they could run a pair of docker containers, one with jellyfin one with wire guard and only have access to the jellyfin instance when logged into the micro sized vpn? (I think docker will let you play with networks that way, I’m experienced enough to be dangerous but not useful)