Plex runs relay servers where your Plex server will connect to the relay and your player will also connect to the relay, making both ends of the connection egress type as far as routing and access control goes. https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/

It’s optional and likely not everyone uses it, but this provides a way for Plex to do remote streaming without the Plex server being reachable directly from the internet.

Separately, it costs money for Plex to run.

In their defense, they also clearly label immich as under active development with frequent changes and bugs.

Edit: nvm I saw it was already discussed in another reply.

You’re right, they’re probably faster than their running speed given humans are faster on a bicycle than running too.

Would you accept a certificate issued by AWS (Amazon)? Or GCP (Google)? Or azure (Microsoft)? Do you visit websites behind cloudflare with CF issued certs? Because all 4 of those certificates are free. There is no identity validation for signing up for any of them really past having access to some payment form (and I don’t even think all of them do even that). And you could argue between those 4 companies it’s about 80-90% of the traffic on the internet these days.

Paid vs free is not a reliable comparison for trust. If anything, non-automated processes where a random engineer just gets the new cert and then hopefully remembers to delete it has a number of risk factors that doesn’t exist with LE (or other ACME supporting providers).