umbrel takes some security shortcuts that i'm not fully impressed with. i've known this for years, but you're only as secure as you're weakest link, so if you secure your home network and are overly cautious, then it may not be a big deal.

https://github.com/getumbrel/umbrel/blob/master/SECURITY.md