Similarly to Nextcloud. If you host an instance and remove preinstalled apps, you are obliged to also remove the Nextcloud branding.

Something like convert filename.rw2 filename.jpeg

Yes

Imho, opening the SSH port exclusively to your computer isn’t a bigger risk than setting up a VPN, if you use authentication by keyfiles a certificate.