Giving them access to Jellyfin is not fully “copying” a movie, it is just access to streaming (they can download, but that’s on them).
Overall, this makes little sense anymore and I feel that limiting data sharing is hard to conceptualize, let alone prevent with regulation.
It works great for a closed group of people, all on one instance. Another data point that federation is hard.