If you self host, your server could still be compromised. I think the primary thing making that unlikely to happen with a self-hosted instance is being a very small target.