Text:
I consent to Plex to: (i) sell certain personal information (hashed emails, advertising identifiers) to third-parties for advertising and marketing purposes; and (ii) store and/or access certain personal information (advertising identifiers, IP address, content being watched) on my device(s) and share that information with Plex’s advertising partners. This data is used to deliver personalised ads and content, ad and content measurement, audience insights and product development. Your consent applies to all devices on which you have Plex installed. You can withdraw your consent at any time in Account Settings or using this page.
Soure: https://www.plex.tv/vendors/ (Might have to clear cache)
Can also read about the changes here: https://www.plex.tv/about/privacy-legal/
They argue against most suggestion with the notion, that existing clients can't handle authentication. The devs prefer working clients over a properly secured backend.
You can now extrapolate this idea and every major change that would change the way the API is accessed by clients will be stopped for the sake of continued client compatibility.
It's this old link, eh?
Well, just because they closed the issue (without resolving it), doesn't mean it does not speak to their views on security and client breaking changes
Yup the old one... here's the new one too... still unaddressed
https://github.com/jellyfin/jellyfin/issues/13983