From what I heard is that the NPM project only has 1 developer and so they can’t really respond and fix security flaws in a proper timeframe.
It's mostly just nginx with a webui. You can even see the nginx config files if you bash into the container. It has the same bugs as upstream nginx. Do not expose the management port to the internet.
Plus compared to normal nginx, it's harder to misconfigure it. Most of my services are just the default config, so I can't mess it up accidentally.
About lockouts: Once also happened me, but that was just a messed up update, next update fixed itself. If you lock yourself out you can usually edit the db directly, it defaults to sqlite, but I used it with mariadb.