I mean, you just listed the most insecure way to host Jellyfin. Poking a hole in your firewall will technically work, but that doesn’t mean it’s the correct way to do things. A good setup would use a reverse proxy, and some sort of authentication wall like Authentik or Authelia.

All of that would only take about 15 minutes for someone who knows what they’re doing. But the vast majority of people setting up Jellyfin for the first time won’t know what they’re doing. And seeing the inevitable “lol just open your firewall” comments only serves to scare them away, because even the noobs have heads that’s the wrong way to do things.