Selfhosted

Not only is it likely, it's pretty much guaranteed that a bot will scrap your network if it's opened to the public.

Look into setting up mesh networks. Opening up a port will work, but it's insecure, while tools like netbird or tailscale still allow you connect to it remotely, but only allow YOU and the people YOU want to allow to connect to it, not the entire world

So the reason you'd want a reverse proxy is because it handles security and would do a much better job of it than an exposed jellyfin port.

Public FQDN -> your home IP -> your router allows 443/whatever to your reverse proxy -> it handles SSL and being hit by the internet (look into nginx security and even fail2ban) -> proxy serves up whatever insecure site/app you'd like.

I use a reverse proxy so I can just use a hostname and not need a port. I run Jellyfin that way no problem, function-wise.

Additionally, not having a domain won’t necessarily protect you since you do have people out there scanning for ports and when they see 8096, they’re going to immediately know it’s a Jellyfin/Emby server and any vulnerabilities associated with those. If you use a reverse proxy, they only see 443 which is…pretty much every other site on the internet. That’s security through obscurity, I know, but it will help mitigate some of the easier attacks.

I’ll say that everything I have to have a port open for (mostly game servers) gets targeted by the internet at large despite the fact that I’ve published the address and port absolutely nowhere online and only shared it with close friends. I almost never get anyone trying to log in to my other services.

So I have jellyfin deployed to my kubernetes home lab, router port forwarded to the ingress controller (essentially a reverse proxy) on the cluster. So exposed to the internet. Everything on it has authentication, either built in to the application or using an oauth proxy. All applications also have valid SSL configurations thanks to the reverse proxy. I also use cloudflare DNS with their proxy enabled to access it and have firewall rules to drop traffic that hits port 80/443 that doesn't originate from those cloudflare proxy ips (required some scripting to automate). It drops a lot of traffic every day. I have other secuirty measures in place as well, but those are the big ones.

So yeah, if you expose your router to the internet, its gonna get pinged a lot by bots and someone might try to get in. Using a VPN is a very simple way to do this securely without exposing yourself and I'd suggest going that route unless you know what you're doing.

Just put jellyfin and tailscale on an old windows computer and it's setup in less than 10 minutes.

Depending on your routers you might me able to set up a “site-to-site” VPN which means your Xbox could connect directly to your Jellyfins local IP

I went about this in a pretty noob way. Synology + Jellyfin and I followed some online guides. Synology gives you a free DDNS hostname so you can access your NAS away from home. I don't have to VPN or anything. I have to warn that using this method will result in having slow transfer speeds if you're uploading large files. I use it to stream movies and shows so it seems to be fine for this purpose.