It should at worst give people a copy of my media if there's a security issue.

that's not the worst possibility. the worst possibility is an RCE into your server.

Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but

that's a pretty exotic setup. Exciting, but for most people learning to manage a VPN is easier