FWIW I use /opt as well for third-party apps. NodeBB, I install in my home directory, but again, it is mostly down to preference. If you install in /opt, you could always change the ownership of /opt/nodebb to something like nobody:nobody, and ensure it's run unprivileged...