Security is fundamentally subjective because whatever objective calculus you use will always depend on the threat model at hand, and everyone’s threat model is different, i.e. subjective. I’ve personally lost a physical credit card but never had my card details stolen in 10+ years of using payment apps.
Hey, what’s your budget? You could go far with a second-hand NUC (next unit of computing), I’m sure you can get one for under $100 and you could do more than just nextcloud with it (peertube, VPN, chat etc).