Is the likely threat not just bots going hunting for targets with known vulns?

For me, yes. It’s all very low effort though, mainly pinging WordPress admin paths. I’ve had a public Nextcloud instance and password manager for two years now and am not concerned. That said, I recognise it’s suboptimal and wouldn’t recommend it to newcomers.