Same here, it's super easy to set qbittorrent on a server. I did put it behind an nginx server but that's just common sense when exposing anything on the web.

The web UI does the job, no complaints.

Well, I believe that setting up a web server should not be a requirement for remote software control. In the case of torrents, it would be great to have the ability to manage downloads on a desktop from a mobile device, no matter where we are.

I understand that Hacker News users are generally power users. If qbittorrent fulfills your needs and you have the skills to setup and secure a webserver, there is no need to switch to another client. Additionally, it's worth noting that PikaTorrent may not implement all the features of qbittorrent anyway.

what's the point putting it behind an NGINX proxy as opposed to exposing it directly? Rate-limiting or fail2ban or something?

Qbittorent in particular has had several webui exploits in the past. The most recent was a few months ago and it was pretty bad: https://github.com/qbittorrent/qBittorrent/issues/18618

Putting nginx in front with http basic auth would prevent all of them.

Not the parent, but:

Hosting multiple services behind one ip:443 and having a valid LE certificate is surely a nice thing. You can even add a simple URI knocking if you wish.