How should they even know? How should they prove that you are in posession of that data? Yes Hetzer most likely has to respond to reports but again how should the rights holder find out? Just because they find a jellyfin server in the wild? Even if the site is not SSL protected they are not Man in the Middle the traffic.