I already have to expose my Plex Media Server with a Tailscsle funnel (for IPv4 only) for IPv6 I use my Synology NAS reverse proxy which can be accessed globally.

I have been maining this setup for years now that I forgot if I can access my PMS outside without either those solutions lol (I am GGNATED but IPv6 works fine as stated).

The main thing here is that I don't need my users to do anything, they just open the app and access it, no need to remember IPs/URLs or install VPNs to my server... Is that possible with Jellyfin as well?

I have mine behind a caddy reverse proxy that forces https. I think that handles most sniffing concerns

Bummer... unfortunately, that's a deal breaker for me to completely drop Plex. Maybe someday.

So I don't get it, I have mine up with a domain without tsilscale.. The clients are quite happy wherever. I don't even see that much "crawling" traffic that goes to the domain, most just hit the server by ip and get a static 401 page that the "default" site is hard coded to give out.

All possible, but currently I have lifetime Plex pass and just need to share with people I want to share with. No extra config. Once Jellyfin can do that or something similar, I'll look at jumping ship. Until then, the juice isn't worth the squeeze.

The first one, yes. That's what I do. But IIRC hosting media via cloudflare tunnels goes against the TOC and they reserve the right to ban users over it