Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

You largely have to for Plex themselves to middleman access to your media collection.

I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.

Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.

I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).