I don't know why everyone in the selfhosting community still even mentions Plex or uses it.
It's closed source, not free; Jellyfin is a no brainer yet people still go to Plex??
See this issue on their github repo: here
Basically from what I understand there's loads of unauthenticated api calls, so someone can very easily exploit that.
If they just supported mTLS in their clients it wouldn't be an issue but oh well :(
Tailscale is simpler but when you're accessing from devices behind VPNs like I do mTLS is a lifesaver.
I use DAVx⁵ for caldav (supports mTLS)
I find mTLS cool too :P
In terms of being a pain it's not that bad with nginx in my opinion. I can just build my own certificate for each service I expose or you use a common one, giving read only access to the key for my nginx containers and in two lines in the .conf it's sorted.
That's just the nature of service migration; of course for people like you who are very dependent on it, it's not a no-brainer, but for anyone who wants to start hosting one of the two, yes it will be.
In your case yes Plex is more appropriate but at the same time the clock is ticking for Plex if they continue on this route...