Public link share of a folder inside a Team folder (groupfolder) ignores read-only permission anonymous delete/rename/move/upload possible
Nextcloud groupfolders was updated last week - and now anybody can upload and delete files in any public link to a groupfolder you have shared!
Either revoke all your sharelinks, or apply the fixed lines yourself to the php files ...