And that would be enough to bypass root settings?

If someone wants to prevent users to mess with the system should he just disallow downloads entirely/confine the user into an intranet?

Enough focus to read documentation.

That’s really it. If your purpose is just self hosting learning bash could also be helpful. And yeah Linux would be a great choice.

But mostly, if you want to self host an instance of Nextcloud correctly and without having to deal with too many unexpected things, you have to read the documentation to correctly set it up.

Docker or not docker you will have to deal with configuration, settings, requirements and updates.