And only for developers who have both the time and inclination to vet each update for themselves, updates which (for big systems) may have contributions from hu

And only for developers who have both the time and inclination to vet each update for themselves, updates which (for big systems) may have contributions from hundreds of people and may be in a language that you only know vaguely. Open source and self hosting is a good start for the paranoid, but definitely not sufficient. As always it comes down to threat models and who/what you are trying to defend against.