Sonarr / Radarr move the files out of the finished downloads folder into the respective media folder.
If they don’t have the right permission for that you should check your setup. Everything in my guides run with user 1000 and they should all have permissions to move each others files around.
Regarding your second question: I don’t quite understand what you mean here? Imo Jellyfin doesn’t have to be in a VPN. It doesn’t do anything in the grey area. If you plan to stream media FROM jellyfin over the internet to some other PC. You should at the very least configure proper SSL or let it go through the VPN.