That is only true when you use their "home" feature. It puts the entire thing behind oauth because it has to do so in order to restrict libraries/content to non-full users. Think about the instance where you have a thirteen-year-old kid and you want to restrict them to pg13 and under. Without forcing oauth on local connections they could just sign out and watch all your star trek porn parodies or whatever you don't want them to see. If you remove the server from a "plex home", it disables the oauth workflow for local connections as expected.

Don't get me wrong, I'm not really happy with a lot of their new sharing/social features, and their recommendations on the homepage can fuck right off, but I do think it's important to be accurate when criticizing. Requiring oauth on local vlans when plex home is enabled is the objectively correct solution.

How about transcoding subtitles on those 4k titles? That's where I find Plex is a bit worse for wear right now in my environment.

Does Jellyfin have an xbox app?