Yes, TLS should be considered a given. Set things up right and you can use TLS locally, too, with Let's Encrypt, which is a prereq to stream some things to streaming sticks using Jellyfin's raw HTTP streaming without a Jellyfin client.