this isn't good for anyone but Roundcube investors.
Roundcube is a well-liked product. Nextcloud is a PHP app with all kinds of security holes.
With regards to security, nothing is perfect but I'm absolutely positive that Nextcloud is ahead of the vast majority of open source projects. And if you know of a security hole, go and collect your USD 10K at HackerOne.