When you say "no built-in security", are you talking about not having https ? Paperless-ngx does have login security with users and passwords. I believe they recommend using nginx as a reverse-proxy server to implement https if you need it.
Try https://joplinapp.org . You can self-host your database with something like Nextcloud or Apache Server using WebDAV. I moved from StandardNotes after they got tricky about Self-hosting.