With the caveat that I’m presuming Jellyfin has a HTTPS interface, or you have a proxy in front of it to make one for it (I use Emby myself but I believe Jellyfin was a fork of it at some point) then yes, if the TV has an app for it you should be fine. HTTPS is as good on your server as anywhere else so long as it doesn’t have some implementation flaw. In fact it’s probably better to not have a VPN when streaming video just to avoid the extra overhead bandwidth a VPN tends to add on.
My only thought against having it on the public web would be the potential for brute force attempts on the login page. If it has a 2 factor option then great, or even if there’s some kind of lockout/throttling after too many wrong guesses. Even barring that though, a decent long pass should be good enough to dissuade anyone from wasting too much time trying to remotely get into a video box, not exactly a crown jewel target after all.