There's nothing about jamstack that requires you to use third-parties (except the CDN part, I guess, but that's just a mirror). You could just as easily host your own CMS and database and call out to it the same way.

It's just that like auth, logging, etc, CDNs have been neatly abstracted out and service-ified in such a way that it's often more economical to go third-party. But that choice is orthogonal to jamstack.

I agree on that, and was going to add that, to be fair to the stack. But the reality is, while that's doable, most people just use third-party services, at least that's my experience.

Sure, but I think that's true in non-Jamstack code as well. Datadog, Snowflake, BigQuery, DynamoDB, Google Analytics, etc. are all examples that I've seen used by non-Jamstack software, and most have a fair bit of lock-in.

jamstack certainly presents itself first and foremost as "use third party services".

I initially learned about it because a junior dev asked for advice on one of his/her apps. It was a college app, simple, it just gathered info from students. But, they offloaded all data to a third-party database. So you are actually giving a company a lot of sensitive, personal information about a fucking college.

He/She was concerned (and with good reason) about the safety of data. Had to learn the bad way :(

I would trust a service by junior devs more if it was hosted by a third-party database because so many companies have insecurely set up their environments over the years. Especially if the data is encrypted in a way the service can't read it, what would be the harm?