Here is some advice then: Don’t run a public service until you understand the risks and are capable of protecting yourself and your users. It isn’t as simple as booting up a service for self use. By using Discord they minimised damages to users it would be worse if they lost control of a Discord alternative with RCE exploits.

Self hosting and providing a public service are two very different things.