If your reverse proxy only acknowledges jellyfin exists if the hostname is correct, you won’t get discovered by an IP scanner.

Mine’s on jellyfin.[domain].com and you get a completely different page if you hit it by IP address.

If it does get found, there’s also a fail2ban to rate-limit someone brute-forcing a login.

I’ve always exposed my home IP to the internet. Haven’t had an issue in the last 15 years.