Since Plex Media Server - as of today - still has a security vulnerability that has not been fixed, I have decided to set up GeoIP blocking in my OPNsense Firewall and restrict access to my Plex server in HAProxy to a few whitelisted IPs.
The Plex server is running in a Jail on ZFS with all the media mounted as read only (mounted via nullfs). Together with the network changes, I hope I will be spared any further surprises...