Jellyfin behind Cloudflared is probably the best move ATM.
It's not specifically against TOS, they do provide you some modest protection against infiltration.
combine that with running it from a container with RO access to your media and you have a damn nice home solution.