Bazzite is my daily driver and I really like it

If this server is publicly accessible and gets pwned, they can use it as a jump box for your internal devices.

Just close 443 and use VPN with ACME DNS challenges for your certs. That’ll help make it even more secure, nothing is fool proof though and a VPN is a good first step

Only if you hook up a torrent client. There’s no requirement to do so

For jellyfin/Plex you can try downloading everything with lidarr