I'm not sure I'd even trust a self-hosted alternative. Presumably this would need to be exposed to the internet, and would be a nice target for someone to break into given how much information it collects.
Wouldn't they have to target you personally, though? (I may be wrong about that.) If so, doesn't factor into most people's realistic threat models.
Not necessarily, just need to find an exploit and start scanning for folks hosting the service. Most would probably use some standard/default port for it.