I use a reverse proxy for Jellyfin remote access, people saying you need a VPN or Tailscale (which is also a VPN) are unnecessarily paranoid IMO. That said, I'm a software engineer with more than 10 years of experience and a lifelong tinkerer, and I've set up an OpenWRT One as my primary router, so my firewall is more up to date and useful than 99% of consumers and I'm comfortable restoring a PC if it gets hacked.

But maybe more importantly IMO, Jellyfin doesn't have a central server that would serve as a high-priority target for hackers. Plex may have funding and full-time devs, but they're also relying on security through obscurity, which is hardly best-practice. Their central servers were hacked 10 months ago and passwords were leaked. For that to happen to me, hackers would have to be interested in my little Intel N100-powered server running from my house with maybe 10 daily active users. On top of that, Jellyfin's team have generally been quite fast at addressing all known high severity vulnerabilities because the project is open source. Everyone can see the code, so anyone can fix an exploit as soon as it's found.

As far as sharing access with my friends, I just ask them to put in the username/password they'd like on my phone in person for account creation, then I text them all the details about the URL for my Jellyfin instance, how to set up their smart TV app for it, etc.

I can access my Jellyfin instance from almost any smart TV in the world with the official apps because I followed their official guide and set up with a reverse proxy instead of Tailscale.