What? Can you elaborate? If I spin this up in a container, even though it has access to the internet, how am I owned within a few minutes, given that my firewall is in place and I don't expose any port of this container to the internet?

Why do you care if you don't open any port on the phone to the public internet? It should be fine running locally in your home network.

If you don't open any port on your phone to the public internet, I guess it's fine for this use case? Most (if not all) home routers have firewall enabled by default. So your home devices are protected from inbound connections.