Yes. You are right. occ update:check says:
Nextcloud 16.0.3 is available. Get more information on how to update at https://nextcloud.com/outdated-php-7-0/.
Of course the argument is poor for a ubuntu LTS distribution which is supported for 5 years.
Running a Nextcloud release without security and stability updates puts your data at risk.
Even though it is php 7.0 it still gets security updates and thus is not or little risk. Much less risk then forcing people to possibly compile the latest php version themselves or taking updated php packages from the next best repository they find in the internet without any idea how well that would be maintained by whoever provides them.
Or forcing people to upgrade to the next ubuntu 18.04 LTS (which of course means in the end that maybe in two years you are in the same situation, again). Not that that will go so easily and well that in the end everything is as secure and stable as before…
Of course, paid customers can get a LTS version of nextcloud… What does that tell me??
Thus, I guess in the end this will simply mean that in a couple of months from now there will be more and more nextcloud installations in the internet with a number of potential security issues that won’t be fixed…
In particular, because at least for the Ubuntu release schedule end of support for Nextcloud 15 end of 2019 it means another 4 months until the release of Ubuntu 20.04 LTS. Thus, end of 2019 when I have to decide to upgrade to Ubuntu 18.04 LTS only to get php 7.2 for updated nextcloud or wait another four months and hope nothing happens and then upgrade to 20.04 LTS and the latest nextcloud.
So it would be much nicer if nextcloud 15 was supported until mid of 2020…