I know how open sourcing works. Just because hosting using other open source servers with less community effort would be worse doesn't void or nerf the possibility.
Doesn't take a top 10 server to get hit with ransoms. All I'm saying is this project gained attention, and based on the tests currently available, it's very obvious what HASN'T been properly tested. I'd argue that makes the server easier to attack, as you don't have to dig into spaghetti code to see what was overlooked - exploits can be found just by looking at test files (poor testing/lack of coverage highlights the potential attack vectors).
It's an incredible contribution to the community, of course. But hosting on top of this would be risky unless you used systems which others can't study, buying time for the team to catch the exploit before the users do. All I was saying is if he were to host this, it would be wise to avoid using systems which are public and not fully tested.