Which doesn't work for The grand majority of devices that would be used to watch said media.

Tvs game consoles rokus so on so forth typically don't support VPN clients.

The Jonathan clients for these devices also typically don't support alternative authentication methods which would allow you to put jellyfin behind a proxy and have the proxy exposed to the internet. Gating all access to jellyfin apis behind a primary authentication layer thus mitigating effectively all security vulnerabilities that are currently open.