As far as I know they do for remote streaming on phones, if they weren't part of my server at the time they introduced the monthly remote streaming subscription. I tried to add a new user after it was introduced, and to use Plex to access content from my server on their phone they no longer had the option to pay the $5 or whatever, they had to sign up for a $2 a month subscription. I don't know if this may have been walked back in the last few months, but at the time it was true.

I don't sell access or anything like that, I've just got friends and family with access. It fluctuates, but right now it's sitting at 17 external accounts. I host on the public internet. Despite it being not recommended in general, it's actually safe to do so if proper precautions are taken. (Correct firewall settings, force https, reverse proxy, scheduled updates, etc.) There are a few extra things I do, but just those should be safe enough if your users aren't reusing passwords.