They even had to come up with their own security scanner (https://scan.nextcloud.com/). I assume because they don't even trust their own code mess or cause you can f-up your PHP conf in so many ways that your server becomes vulnerable.