The other side of this is that unless you're a very important individual nobody is going to blow zero days on your self-hosted server, and you're pretty unlikely to get focused by individual human (non-automated) attention/exploitation.
I've been self hosting for over a decade with no intrusion to my knowledge, although I'm sure some state-level actor has access. On the flip side I've had many of my login credentials stolen over the years due to a wide range of companies getting hacked- haveibeenpwned currently lists 11 breaches for just one of my emails. It's probable I'll get owned eventually, but I've got some catching up to do.
I mostly agree with your post, except using a zero day on a small (especially self-hosted) server is very rarely blowing it. In fact I would bet the majority of self-hosted or small-time servers wouldn't have the first clue about how to figure out how you got in, let alone parsing logs to figure out the exploit. Assuming they even log sufficiently, hiring a forensics expert is almost certainly out of the question financially.
I wanted to write exactly the same comment: it is a lot less likely to be targeted. The big company leaks happen often because A LOT of resources and human hours go into trying to find flaws in their security.
Not only that, but the reward is a lot smaller for the attacker and the overall damage is smaller for the community. If attackers get into Google Analytics/Tag Manager servers they will be able to find data and sensitive information about most of the websites in the world and be able to control them. If they get into your self-hosted analytics server they would only find out your stats which can't be used for much.
There is one thing to find the name and phone number of one person and another thing to find the name and phone number of millions of people.
No, only the traffic of the self-host server you whitelist on Pritunl using the self-host server IP goes through VPN. Rest of the internet traffic works as usual.
I've been self hosting for over a decade with no intrusion to my knowledge, although I'm sure some state-level actor has access. On the flip side I've had many of my login credentials stolen over the years due to a wide range of companies getting hacked- haveibeenpwned currently lists 11 breaches for just one of my emails. It's probable I'll get owned eventually, but I've got some catching up to do.