People are likely to use weak passwords with Plex, just like they do with Netflix, so that they can easily share the details with other users and input it easil

People are likely to use weak passwords with Plex, just like they do with Netflix, so that they can easily share the details with other users and input it easily from memory on things like TVs and tablets. I think generally people consider it low risk, because "who cares if someone can see what I was watching", but if you can get RCE on a computer running Plex Media Server just by logging in to the Plex account, then of course that's a huge security surface and your Plex login should be a secure randomly generated password and have 2FA enabled. Of course, this can be avoided by paying for the premium Plex subscription which allows you to create accounts for other 'non-admin' users, but for people trying to avoid spending money (a large number of the Plex user base probably), then anyone with the login can change settings/administer the server.