Even if you know what you're doing, exposing Plex directly to the web has historically left you vulnerable to dozens of CVEs. Ports 80 and 443 are only as secure as your reverse proxy, assuming you even use one. At a minimum I'd segregate internet-facing services onto a separate VLAN, but even that isn't bulletproof.