@mikolajek Yes, there is one other security issue that I am aware of and managed to uncover in the below thread.
Any Plex account has the ability to discover any other Plex account by simply searching for them (or programmatically scraping for them). There is no way currently to stop this.
Plex Employees have however stated that they are to implement some privacy settings allowing Plex account holders to control this discoverability.