I agree with you, however Jellyfin is not intrinsically more secure than any other piece of software. You have to be very careful how you go about deploying it if you open up external access, as you are dependent on the Jellyfin devs to fix vulnerabilities and they aren't actually being paid to do this. If you're paranoid about privacy, you should be paranoid about this too; the people sending subpoenas aren't above port-scans on ISP subscribers, they did it back in the early days of torrents.

You get control and privacy, but you also get responsibility. It's a trade-off, and one I'd certainly make if Jellyfin were more mature. That's just me though, I've been hosting my own stuff for about a decade now and I can set up an isolated environment for Jellyfin to run within. Plex is a lot more newbie-friendly and I'd still recommend it for most folks unless they for sure know what they're doing.

As an aside, these concerns are common to all FOSS software that don't have deep-pocketed backers. Jellyfin is likely never getting those, unfortunately. I hope they can find some other way of sustaining themselves, they've not got much money for the scale of development needed and it's all volunteer-driven today.

https://opencollective.com/jellyfin

I want them to keep going, and I've even donated to them. I still don't think it's at a place to replace Plex for most people yet though.