Here’s the problem;
On a Synology, your main access and where you store all your data is under /volume1 which you control through the Control Panel - Shared folders - Permissions tab. Should you have a larger model, or partition it differently, you might have /volume2 and/or /volume3 . These are the Synology-assigned names for each logical disk group. These are shown to you in Storage Manager.
There is no user-data above these points. Everything is generic OS programs and data.
Everything on the Volumes is yours and completely under your control. If you don’t want Plex to see it, it can’t.
Where a misunderstanding often comes in is, just like Windows, sure you can see C:\Windows and read C:\Windows but would you put media in it? More importantly, do you see it from the Desktop? The answer is No. You see your desktop. You must specifically navigate to get to C:\Windows. Linux is a bit different and Synology’s implementation of their storage on Linux is grafted into the typical Linux hierarchical file system .
Windows always has devices at the top. There is no such concept in Linux. Everything is grafted into a hierarchy tree. This is why you see /volume1 represented as it is.
Because you need to be able to tell Plex where you store your media, You, as machine admin, must be able to navigate to the correct folders. This is why you see the operating system’s folders as you browse down to where your media is.
On DSM, you see your Volumes from the Desktop. The entire OS around it is hidden. Synology wrote very DSM-specific code to do that. Plex will run any Linux machine. It cannot make any assumptions.
This isn’t a problem of security or ignoring permissions.
DSM set the permissions so all applications can read the OS directories. Without this, DSM would not run .
With respect to all your user data (which is what is important here), I have reduced PMS to the absolute minimum permission level. It is a ‘generic user’. Your DSM sign-in has more permission than the Plex user (when PMS starts).
Those operating system folders you see as you navigate down to /volume1 are so small, you can’t fit a video file in them.
Please accept this is the nature of Linux.