Changes made by Syncthing do not show up in the activity app. Agree that the storage indicator does not work with external storage of any type. For me this is not an issue since Syncthing is “primary” for lack of a better word. Nextcloud is secondary for the sole purpose of accessing through a web browser and iPhone.
As to the local storage issue. Do not see this as a security risk. For example an attacker who has admin privileges can create new external local folders to anywhere they want. Utilizing external local folders is just using a feature which is already turned on and ready to be exploited by an attacking admin user. Not using external local folders in no way prevents another admin user from doing so unless the external storage app is turned off, but then an attacking admin user could just re-enable the external storage app. For these reason do not see using external local storage as a security issue.
Of course file system permissions also matter in terms of adding external local storage to any folder on the system as a whole. As long as Syncthing is running as www-data many folders will not be available as external local folders through the Nextcloud external storage app. What are your thoughts as to the security implications?