You got it – I try to talk daap or rsp over the internet without any tunnel or VPN. The firefly accepts connections on a publicly available IP.
I think the problem is more a Soundbridge issue than a firefly issue. I wonder whether there is something missing in the Avahi configuration, so that the Soundbridge also shows the share. Since the share is accessible via iTunes the overall setup seems to be ok.
And I agree – from a security perspective this is not the optimal solution, even if the server is password protected.