The authentication is lacking 2fa and has a half hearted attempt at fail2ban

If you try to properly implement either of those, the standard device clients won't work anymore.

Plex provides default SSL.

The relay is actually a bit more useful.

You can be on a carrier grade NAT with no real external IP.

It's more akin to running a VPS somewhere and SSH tunneling your home server through it.

They also cache* the entirety of the TVDB and EPG Services.

I'm not sore about most of this with jellyfin, and I am trying to primarily use it, but I really miss some of the features. But realistically, adding 2FA to the clients would be a huge benefit. trying to replace 2FA with wish.com fail2ban feels particularly dirty.

Relaying gigabytes of traffic per user costs serious money. Rely on them to do it, and they are either going to charge you or are just waiting to charge you when their VCs come knocking.

Having to set up a reverse proxy is basically a non-starter for most people, while I've talked extremely non-technical people into running Plex since it just works out of the box.