Don't get me wrong, I still use NextCloud, but you can only access my instance through a VPN (or by being on my home network where my server runs). I would suggest that everyone else does the same if you're hosting your own data.
I have been using it for 4 years, and I recall one in the past year, but Nextcloud was loud and clear on making sure you had to upgrade. It was even nicer with auto updating on Debian, I didn't have to do anything to get my server patched (I just went in to confirm it was patched).
However it's hardly unheard of for PHP to have RCEs. Usually the RCEs are in programs written in PHP, but PHP itself is hardly blameless. For comparison, Python has had 5-10 code execution CVEs in the past 10 years.
And again, I'm not bashing PHP or NextCloud here. I would probably also firewall NextCloud if it was written in Python. The only thing protecting your data from being public is a single service that you are running and gated by a basic login form -- I personally feel much safer with it behind a WireGuard VPN.
[1]: https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_i...
I would love to see Nextcloud create a "time machine" type box, where it runs both as your router and as a "home cloud" service. That way it would be much easier to configure it as a public facing service.