Running an up to date self hosted Gitea server takes like 5 minutes a week.

I mean, last year, but if you're updating once a week now, that means you've had 6 days to get exploited.

Nope. Take a look at gitea update frequency.

Missing the point completely. It doesn't matter how often they update, it matters how fast attackers find exploits.