When does the rugpull happen? I see using a third party auth as a suicide pact. What stops Supabase from sending out the usual email that "they're proud to have been acquired?"

You can actually self host Supabase, that's really the whole point: a Firebase alternative that you can host yourself. Obviously you can use their hosted service as well.

I think supabase is open source such that you can (and many customers do) self host with no additional cost and with complete control.