Fair. I guess what really prompted this question was a chat with a “normie” relative who was self-hosting jellyfin on their main computer, no security (username: user, password: pass, SSL: disabled). I had to explain all the issues (even no fail2ban on their server with an exposed port 22). They thought I was paranoid. But even my suggestions weren’t as extreme as many people put.