The authentication is lacking 2fa and has a half hearted attempt at fail2ban
If you try to properly implement either of those, the standard device clients won't work anymore.
Plex provides default SSL.
The relay is actually a bit more useful.
You can be on a carrier grade NAT with no real external IP.
It's more akin to running a VPS somewhere and SSH tunneling your home server through it.
They also cache* the entirety of the TVDB and EPG Services.
I'm not sore about most of this with jellyfin, and I am trying to primarily use it, but I really miss some of the features. But realistically, adding 2FA to the clients would be a huge benefit. trying to replace 2FA with wish.com fail2ban feels particularly dirty.