Jellyfin doesn't open up your network unless you specifically allow remote access exactly like Plex. The only difference is Jellyfin doesn't have the encrypted tunnel built in- you need to know it needs it and add it yourself.
Plex has had bugs that allowed remote access into your home's Plex server. https://nvd.nist.gov/vuln/detail/CVE-2025-34158
Which Plex does by default. He doesn't understand that running Plex at home opens itself up to the Internet. I specifically referenced a CVE that let hackers into your home if you ran Plex.
His claim that securing Jellyfin with an encrypted tunnel does nothing is false.