I think it is a matter of time honestly.

Jellyfin has grown enough in popularity that it is likely a target for a state actor looking to create some minions. Just because there isn’t any known remote code execution vulnerabilities doesn’t mean there couldn’t be one in the future.

Maybe I’m being paranoid but it seems way safer to just not expose Jellyfin.