You don't need to expose radarr/sonarr to the internet. Only your torrent client needs external access which would be routed through a VPN that offers port forwarding like AirVPN.
For hardware, I'm a big proponent of DIY. A NAS is very expensive and limiting since it has a fixed amount of bays. It's much more econonomial to buy a case that can hold a ton of drives like the Fractal Design Define series and then run your own hardware. I'd suggest 32GB of RAM, a modern i5 CPU with QuickSync (for Jellyfin), and a motherboard that has as many SATA ports as you can get. Check PCPartPicker to compare features and prices.
To run everything, you might look into using Proxmox and then running all your stuff off that in VMs or containers.
I'd probably keep PiHole separate since you only need a RPi3 and you don't want your whole network to go down if you restart the server. The rest can be run off the server.