I run nextcloud on my machine. If there’s some loophole, there would be one in their hosted instance as well. There’s nothing really I can do about security of it.