[heliosAtwork]

No, open source does not prevent anything. There is just more transparency.

Any self hosting would need to be fully connected with automated update notifications from the "crowd" of contributors and reviewers.

I guess, it becomes a managed service at that point (since as you point out it should have reliable and secure production characteristics which does require a high level of competency). I am imagining a cloud of one for my passwords (a stateless, secure container, with disabled user access to the OS and which connects to an encrypted simple file store to keep my small sized but precious passwords).