Self hosting likely makes it much much worse. I'm willing to bet a lot on the fact that most authors of these comments do not have any kind of experience with serious security or compliance programs.