Self hosting is hard. You need to take care of security, backups, software updates, software installation and so on. Even on something like a QNAP (which can be compared to managed hosting) this can be hard. Flip the wrong switch and you expose something to the world. Missed a security update: your device is now vulnerable. While I host a lot of things myself I can understand self hosting is not for everyone.
I tried it but there are so many traps you can fall in, like security settings as mentioned by you. When i had my server online back then, it was hacked 1 week later :D
_anyway_
I haven't been hacked.. yet. /me knocks on wood
The precautions I take are basic:
- Use unique and secure credentials on each service I expose.
- I only expose ports 80 and 443 to the public. 80 HTTP redirects to HTTPS/443
- I keep my software updated (docker-compose pull)
- Nightly backups to cloud storage and local disk
- I "airgap" my home network from my hosting network. There is no shared hardware between them including firewalss/routers, switches, etc.
I figure cloud services and SaaS get hacked anyway. I can't enumerate the breaches my data has been a part of. If my self-hosted stuff gets hacked at least I can do the forensics and actually see what happened and what was accessed. With a 3rd party all I can hope for is what their PR department lets out.