Remember: noise cancelling works by playing the inverse waveform to cancel out the external one. That’s still pressure waves in your ear; they’re just no longer registering as sound.
There have been plenty of studies in this area; to minimize the risk of hearing loss, keep the headphone audio between 60 and 85 dB (remember: it’s a logarithmic scale)
Anything from 70dB down should be safe; you want to listen to 70-80dB a maximum of 40 hours a week, and 80-85 a maximum of 8 hours a day.
It doesn’t matter where the sound is coming from; those are just the guidelines for sound waves in your ear canal. Headphones can actually muffle external sounds louder than 85 dB, protecting your hearing.
Most phones have a setting somewhere to prevent the headphones from emitting sound over 85dB; this is required to be the default by law in the EU.