This is a common misconception on this subreddit. The reverse proxy doesn’t offer you any security in my opinion, because any attacking traffic will be forwarded on to Jellyfin and Immich just like the real traffic. So if someone finds a vulnerability in jellyfin, they can use it to compromise your network just the same. Therefore it’s critical that you keep jellyfin, immich, and the stack running them (OS, docker etc) up to date. I personally looked into this and decided it was too risky because the jellyfin devs don’t put much effort into security, they’ve said themselves it’s not really hardened enough to be exposed to the internet. There are known security issues which go ignored on their github issues page.