FOSS isn’t always more secure than closed-source, but it absolutely can be.

It depends on the priorities of the maintainers. It seems like Jellyfin’s maintainers might not be putting a huge emphasis on security, which is very disappointing, but they are volunteers at the end of the day.