Yeah, and in contrast to the Jellyfins devs, they acknowledged a security risk and fixed it. The chances of Jellyfin actually doing something to improve the security is rather slim, since they prioritize client compatibility