I definitely like sandstorm approach over nextcloud plugin model that tries to make nextcloud do everything. It's a security nightmare

I do too, and I feel Sandstorm has the superior security model of most of these platforms. But a key perk of Nextcloud is that it can be installed on cheap shared hosting which doesn't grant the customer root access.