I guess this relates to
https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/ though I note that page is covered in "for best experience, use a direct connection" aka "use port forwarding"
if so that page probably explains why, if you don't have a direct connection then you need someone (jriver in this case) to have sufficient infrastructure available to bridge the 2 and such infrastructure has a cost attached to it.
The other way to look at this is whether opening a port is really that big a security risk. This one entirely depends on how secure MC is (which would tell you how feasible it is to exploit that port) and how probable you think it is that someone will hack a random home network on such a port. The latter is surely a very low but not zero probability, I don't know how to quantify the former.
An alternative is to run a VPN server in your network and only connect via that route. This means you're no longer putting your trust in MC for security, you're putting it into the VPN instead. This will surely be a harder nut to crack.