Anecdotal security risks of exposing JF to internet

[ploni]

I normally access JF only through Tailscale but I am considering exposing it to the internet, perhaps using Tailscale funnel. I have seen many discussions of whether this is safe and I have also seen the list of potential security issues on GitHub (unauthenticated play being possibly allowed etc). I have also seen JF statements that exposure to internet should be done with caution. I am curious about how common issues (being hacked) are in practice. Googling ‘Jellyfin hacked’ brings up almost nothing. Is there any anecdotal or other data?