Plex was running on his private computer, not a dedicated server, right?
They opened it to the internet - that's the big difference (and the topic at hand). Security is a multi-layered thing, but if your weakest point is a gaping hole, the rest doesn't mean much. To my point - assuming Jellyfin ain't gonna have vulnerabilities even when you're fully up-to-date, is foolhardy.
The source can be found here: https://terrorismlegislationreviewer.independent.gov.uk/ (direct link)
It's an independent report by Jonathan Hall KC presented to parliament. I think everyone is under the impression that those highlighted paragraphs are a statement of law, they're not. But they are the guy's (correct) interpretation of existing law - namely, Schedule 3 of the Counter-Terrorism and Border Security Act 2019.
The report itself is a good thing, coz now we know how far the UK government will try to stretch their powers and what we need to repeal when Labour (and the Tories) fucks right off.
As part of his summary:
Some of the powers and offences extend well into the zone of political activity, journalism, protest and day-to-day human activity. However useful, they must be tested against misuse and overreach.