I don't see how. I run them with no public ingress, no plugins or mods. I don't torrent. I'm not sure there's really any attack vector worth worrying about. Certainly no more than many of the other services I host.

what the hell are you smoking? even the silly article earlier had the caveat "Yeah it downloads EXEs but its up to you or your family to run them"

and that's totally ignoring the fact that it's only a supremely naive user that hasn't yet refined their filters to exclude dangerous extensions (or, if they're too lazy to do that, rely on one of the many many pre-assembled filter/grabber settings across the net which already do so.)

what fear-mongering and FUD-spread.

You may also want to warn the public about the dangers of having curl, wget, python or gcc installed.

They expose a PLETHORA of attack vectors! you're probably already compromised, realistically!"

... and they're actually more dangerous than a free-floating EXE.