This is what everyone always says, and yeah, for most people this is probably the most secure and easiest option. But for me it's too much hassle for my family, too restrictive, and not at all what I'm looking for.
However in this thread I've learned that JF supports https, so if done carefully and properly, I can expose it to the Internet directly, which is what I plan to do. Eventually. Plex is still easier for now.
For a reverse proxy, would cloudfare be sufficient?