I‘m using a hosted Nextcloud instance from Hetzner and I have no idea what this is running on either. There’s a significant number of people who didn’t set up their Nextcloud instance, so people not knowing what it’s running on isn’t too surprising.

Wtf it’s not even their job to protect against malware. Don’t most browsers have warning banners for known phishing and malware sites? Just let them handle it.