Like with all these things it's a trade-off. If security is important to you above everything else, then yeah, host it yourself and spend the extra time. But this is true for only a tiny % of startups.

Also, you're assuming that you're better able to secure this stuff than they are. Which doesn't seem obvious to me.