Guess you won’t be making issues there for a while eh

If you really need to expose something to the internet set yourself up an SSO/OIDC provider and have it sit in front of the service and have a deny-first policy in place, whitelist the known few IP’s that need to connect regularly or alternatively geoblock.

Also suggest setting up some security headers, however headers can be confusing for beginners.

Virtualize or containerize everything.

I can see the appeal of downloading YouTube content opposed to streaming, however if folks are looking to stream I would suggest Invidious + Freetube.