Yep, though with calibre in particular you want to kind of make sure it's locked down real good. People sniff for the ports it uses, so open calibre-web libraries get found quickly, and then will usually have some attempts at cracking.

I had mine set up as a local-only thing (could only access from my home WiFi), but from experiences with other apps that have similar crawlers, it takes about a week for them to be found. Just make sure everyone's passwords are decent, or just share one account if it's people you trust.