Does this introduce basic UX changes, like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate?

Edit: And making it more secure? Just because it is commonly for LAN doesn't mean it can be insecure

Including, but not limited to, sending passwords in cleartext on login.

i believe the maintainers stance is that jellyfin should not be exposed and it should always be behind a vpn