Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

I never said anything about using the VPN as an ACL. All I said was to only expose the service over the VPN. That doesn't necessarily mean that the app doesn't have authentication or authorization.

I'm also only talking about residential use cases, where it's a common practice (when not using a VPN) to just expose everything via port forwarding. Businesses aren't setting up Jellyfin on their servers.

true, fun fact a VPN is also an application with an auth layer. dun dun dun!

Sure, but someone would have to first get on the VPN, and then find vulnerable apps once on the internal network, as opposed to just scanning the internet for public-facing vulnerable systems. Wireguard (and thus Tailscale) doesn't respond to port scans at all - it only responds to packets that are signed with a known key.

Admittedly, networking and network security isn't my specialty so I'm absolutely sure you've got more knowledge in this area.