Also, self-hosting does not inherently make something more secure, especially if it's sitting on the public internet. It requires consistent monitoring and correctly setting up alarms for strange behavior. If monitoring is done wrong, it could be a while to find out someone gained access, if the malicious access is even noticed.

While Okta seems to have a number of issues, they don't represent all companies handling access management.