Have fun: https://github.com/jellyfin/jellyfin/issues/5415#event-17377530652

By your logic the *arr suite isn’t self hosted either since they rely on metadata cache servers.

In fact Jellyfin relies on external services for their metadata too!

Hate to say it but it honestly doesn’t sound crazy hard to just block any instance that pops up. Yes it’s whack a mole but if it’s an automated script, it can just crawl through a backdoor instance and ban any domain it sees.