You could put a Site2Site VPN on their router and your router. Bonus points if you use firewall rules to allow only your media server instead of your whole network.

I think it's not a widely used phrase yet

*defeats your purpose of Plex and Jellyfin

I just want a media server. I have no use case to make it available to the public internet.

I use Prowlarr, but had to configure it in Sonarr. I don't see any option for it in Prowlarr

I was also flabbergasted when I observed this. No idea why this is not default, but you can configure "Fail downloads" = "Executables", "Potentially dangerous" in the Sonarr Indexer options to prevent these downloads. Enable advanced settings first.

No.