Running an up to date self hosted Gitea server takes like 5 minutes a week.

I mean, last year, but if you're updating once a week now, that means you've had 6 days to get exploited.

Nope. Take a look at gitea update frequency.

	▲	pixl97 an hour ago \| parent [-]
		Missing the point completely. It doesn't matter how often they update, it matters how fast attackers find exploits.