I had long discussions with some mailcow contributors and it turns out, that some default settings can lead to an open relay if you are not careful. The biggest problem is that they use postfix. Postfix is not bad itself, as it is probably the most battle tested mail server. The configuration of postfix is a different story. And even if I prefer battle tested GNU/BSD software, postfix would be one of the rare exceptions where I would be careful.

I had a postfix running for years without issues, when I self-hosted SimpleLogin, and I fully agree with you. Once it runs, you only need to make sure that the security is managed.