We self-hosted dozens of WP sites for years. It definitely requires careful attention to keep it secure and performant. As you say, one important factor was to

We self-hosted dozens of WP sites for years. It definitely requires careful attention to keep it secure and performant. As you say, one important factor was to carefully control plugins. As an in-house team, we were able to manage these on behalf of our colleagues rather than allowing a free-for-all. We switched our WP hosting to WP Engine a couple years ago and have been happy with that.