Anecdotal security risks of exposing JF to internet

[TheDreadPirate]

Definitely going to echo Mikul's sentiment that private servers are NOT attractive targets. There is little/no money in it for hackers. The most unsolicited activity you will get on your server are low effort script kiddies looking for unpatched Windows 7 hosts.

The statements The Jellyfin Project makes about exposing Jellyfin directly to the Internet, without a reverse proxy, is less about Jellyfin being insecure and more about there being no effort made to make Jellyfin secure. Does that make sense? This is why we recommend having a reverse proxy in front of Jellyfin since Nginx/Apache/Caddy/etc. ARE hardened and significant effort has been made to make them secure.

Keep your OS up to date, keep your reverse proxy up to date. You shouldn't have a problem.