To be clear, I am all for self hosting stuff, but it needs to be in a proper, affordable, standardized package that can be kept secure and useful. A phone is NOT that.
There's a risk of kernel exploits, but I can't remember the last time the Android kernel had a bug that could be triggered by simply sending packets to it. Privilege escalation works, maybe, but getting root on Android is a lot harder than most Linux servers because of the very strict and isolated SELinux contexts.
I've installed termux on my phone and I can install nginx with a single command. Downloading a Debian chroot and launching a full, maintained Linux distro is two commands away.
Until remotely triggered Android kernel exploits become a thing, I don't think the updates are the problem here.
RCE from Bluetooth packets has happened uncomfortably often - CVE-2017-0781+2 (BlueBorne), CVE-2020-0022, CVE-2022-20411, ...