Tailscale has native clients for all the major TV OS’. And I’m not whitelisting public networks for my friends’ convenience. If they’re traveling, they use tailscale with their mobile device or not at all. If you’re talking about IP spoofing that’s not a realistic vulnerability concern for a home media server.

At least I know the potential attack vectors for my Jellyfin server and can mitigate potential security concerns.

Tailscale and IP whitelisting are both viable options

No, but that’s easy to setup with Tailscale or a myriad of other solutions for free.

How is Plex significantly better than Jellyfin at those things? I can just create a user in 2 seconds on the admin dashboard for Jellyfin, set a temporary password and my friend can log in and change it to whatever they want.

I can even limit the streaming bitrate to the account if I need to avoid bandwidth issues.