Yeah, I felt a little uneasy putting my data on something which could be broken into. Still do, having seen my share of hacked websites at work.

If it helps you, I host everything in subdirectories with non obvious names, so bots only hit 404 pages.

Nextcloud.bonk.xyz -> nope Bonk.xyz/nextcloud -> nope Bonk.xyz/bonkcirrostratus -> good luck guessing that