It’s a checkbox in the installer, easy to miss. Has defaulted to off for a very long time now, basically ever since SSDs have been commonplace.

The default depends on your storage. It has defaulted to not load on startup for me any time I’ve installed it to an SSD.

Jellyfin has some security issues that, depending on who you ask, are either critical vulnerabilities that make it completely unsafe to expose to the Internet or largely unconcerning for regular users.