I used Immich for years, but this self-hosted Google Photos alternative is even better
(www.androidauthority.com)
If you implement a 3-2-1 or 4-3-2 backup strategy, test your backups, and do not open any ports on your host, you'll likely be alright. But it's an understandable concern.