Self-hosting and security don't necessarily go hand-in-hand. For laypeople, self-hosting is usually worse: they don't know what threats to protect against, and even if they knew what to protect against they wouldn't know how.

And Twitter is where the audience is.

By self-hosting I would propose the Gmail/G Suite model. Managed service but the organization controls users and the DNS.

That’s not usually known as “self hosting”

No but owning the namespace is important. It puts you, not Twitter, in the driver's seat.

Jack's account is self-hosted on a website he runs. It just happens to be Twitter dot com.

That's a view for sure, however it seems that some world leaders and corporations have decided that the trade offs are worth the risk...