Yes, I'm aware of the Ubuntu/ownCloud repository mess, as I was also affected myself. I'm not too worried though -- it's a personal virtual server with a custom ownCloud endpoint, and the password file is encrypted anyway.

These are always a bit of a balancing act on what's good use of third-party services and what's worth handling yourself. Services hopefully have a competent team behind it monitoring it (not guaranteed though!), but at the same time provide a much more lucrative attack target. And in my case at least, in a completely different jurisdiction. Monthly feels, service continuity, learning aspect... There are lots of different points influencing the choices.