I think the bigger issue is that Yunohost isn't containerizing anything, so a single app compromise can cost you the entire server. It's one of the only self-hosting platforms which doesn't really do anything from a security standpoint to protect you.