It is authenticated, i.e. only logged in users have access. Prosody is well tested XMPP implementation and is used in many production application. meet.jit.si is unauthenticated deployment and many people use it.

I wouldn't call it a tiny bit of functionality, MUC and SFU are the two main components of any video conferencing solution. XMPP helps provide MUC capability, Jicofo is the component you can see the implementation here https://github.com/jitsi/jicofo

BOSH does not allow all operations available via XMPP standard, there are restrictions possible, to maintain security.