Not sure if it is still like this, but jellyfin used to leak massive amounts of metadata. For example by checking the thumbnail paths (which were unauthenticated) you could see what shows/movies someone had.
Might want to warn the "friend" if they don't have auth on the tunnel itself.
They can also take action if they decide you're wasting their bandwidth or (especially) cache space. It's not allowed to host video files on any free cloudflare plan due to cache space.
Might want to warn the "friend" if they don't have auth on the tunnel itself.