Am I making a mistake by having my Jellyfin server proxied through nginx? The other service I set up did need to be public so I just copied the same thing when I set up Jellyfin but is that a liability even with a password to access?

You are probably lucky, for now. I’m pretty sure they are rolling it out in waves. Boiling the frog and all that.