Unless there's a bug where jellyfin or plex decides to execute a random exe it tries to index, exploitation seems unlikely.

That’s been a thing for years. No one is actually running the exes, or at least they shouldn’t be. Its such a simple thing to prevent too…

Simply put, skill issue. Never ran into anything like this when using reputable private trackers and indexers.