I wanted to write exactly the same comment: it is a lot less likely to be targeted. The big company leaks happen often because A LOT of resources and human hour

I wanted to write exactly the same comment: it is a lot less likely to be targeted. The big company leaks happen often because A LOT of resources and human hours go into trying to find flaws in their security. Not only that, but the reward is a lot smaller for the attacker and the overall damage is smaller for the community. If attackers get into Google Analytics/Tag Manager servers they will be able to find data and sensitive information about most of the websites in the world and be able to control them. If they get into your self-hosted analytics server they would only find out your stats which can't be used for much. There is one thing to find the name and phone number of one person and another thing to find the name and phone number of millions of people.