Is using a VPS with WireGuard really more secure for hosting web services?

[TheDreadPirate]

The level of access gained from a hypothetical exploit would determine what they can do afterwards. This is the reason that Jellyfin runs as its own user for direct Linux installs and our documentation recommends running a docker container as your user instead of as root. Because a hypothetical exploit in Jellyfin while it is running as root would grant an attacker significantly more access than an unprivileged user.

Even then, not all exploits would grant an attacker unfettered access to the system or resources on remote systems networked to it. Perhaps it would only give them access to the contents of memory, they can't write to disk to make their access persistent.

Having said that, a random attacker is very very very unlikely to want to expend that kind of effort on someone's Jellyfin server and home network. If they have the skill to find and exploit a, probably, zero-day vulnerability they're going after someone they can actually get a big pay day from.