

It has several unsecured endpoints.
https://github.com/jellyfin/jellyfin/issues/5415
If you read the comments the devs know it’s a serious issue but don’t want to break backwards compatibility fixing them. Their solution for now is to warn people of the risks of exposing their instance to the Web. Which I don’t think they’re doing a great job of.
Good news, you don’t need an app for audiobookshelf. If the iOS devs are trying to leach money from you, you can just use the web client to stream your books. The only downside is I don’t think you’ll be able to download files for offline use.