The vault is client side encrypted so it doesn't actually matter. My host provider could be the robot devil living in North Korea and it wouldn't matter, that's literally the defined purpose of encryption, secure communication across adversarial channels.
I don't really understand why people bother with this security theater, all the self hosting is completely redundant.
I don't self host because of "security theater". I do it because I want to control my data and not be at the behest of a third-party to resist the siren song of enshittification.
I don't really understand why people bother with this security theater, all the self hosting is completely redundant.