Doing it safely is pretty simple.

Install Tailscale at both ends. Done.

It's a fully encrypted mesh VPN.

If you need access without the TS client on the other end, that takes a little more work. Then you need to enable the Funnel option.

Is a domain name strictly necessary though? You would need a static IP. I thought you needed something like a VPS or VPN — I know what a VPN is, but I think it was something with a similar acronym — and that was a service that cost money.

With Plex it just works. When I load up Plex on a remote machine, first it tells me my server is offline, because my server is a Mac and Macs are sleepy bois, so it wakes up the Mac, which wakes up the drives, and then the server loads up and I can play pretty much anything.

I've ran Jellyfin on both Mac (current setup) and Windows/Intel. I like Jellyfin overall, and it does some cool things Plex doesn't. Like you can fix details Plex won't let you. Like for some reason it only lists the foreign actors in anime, you can manually specify the English voices if you want. Plex doesn't let you do that and AFAIK there's no way to. (There should be an API out there that taps into a service that lets you access any language cast, and there should be a way to set it to dynamically change the cast to whatever language you have selected.) But anyway, Jellyfin is somewhat fine, but to use it on other devices (e.g. an Apple TV box on the same network), you have to do a fair bit of configuring. It's not just, log into the account on your phone and type in the text on the screen. Jellyfin doesn't even prioritise Apple development, but they have come a long way.