Plex already supports remote access via UPnP. https://support.plex.tv/articles/200289506-remote-access/
Tailscale is able to hole punch in scenarios where UPnP is disabled (just good practice) as well as many NAT environments.
To me WireGuard is safer than exposing services directly to the internet.
Tailscale is able to hole punch in scenarios where UPnP is disabled (just good practice) as well as many NAT environments.