Ah, personally I just figured I’d use wireguard. I have few enough users that a bit of setup isn’t a huge issue. No way I’d want to expose it completely publicly, same with any other home servers I run.

The public availability without open ports is indeed a strength of Plex.