Nowadays I only really use Jellyfin, but before that I exclusively used mpv. As for why, I just felt it worked a bit better (not sure if it has to do with codecs) and I liked how it suited terminal based workflows.

Does anyone know if the NixOS packages are safer from these types of attacks? As far as I know many packages are missing maintainers.