Yes. You only need to pay if you’re connecting via their relay or trying to use the remote hosting functionality. But since a VPN would land you inside of the network, you’d be fine. You’d probably need to dig into the plex settings to specify that the VPN subnet is LAN traffic. But after that, you should be good.

I mean, you just listed the most insecure way to host Jellyfin. Poking a hole in your firewall will technically work, but that doesn’t mean it’s the correct way to do things. A good setup would use a reverse proxy, and some sort of authentication wall like Authentik or Authelia.

All of that would only take about 15 minutes for someone who knows what they’re doing. But the vast majority of people setting up Jellyfin for the first time won’t know what they’re doing. And seeing the inevitable “lol just open your firewall” comments only serves to scare them away, because even the noobs have heads that’s the wrong way to do things.