If Jellyfin had a vulnerability, it could be exploited, but this can be mitigated with the proper permissions being set on the server: don't run with admin privileges, limited access to the hard drive, etc. If your server supports it you can limit access geographically although there are obvious ways around this.