The vault is client side encrypted so it doesn't actually matter. My host provider could be the robot devil living in North Korea and it wouldn't matter, that's literally the defined purpose of encryption, secure communication across adversarial channels.

I don't really understand why people bother with this security theater, all the self hosting is completely redundant.