Plex is riskier just by having a cloud things phone home to. One target to hit that can affect multiple users.

Depending on your use case, jellyfin may actually be more secure.