We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure. What happened An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication...
By your logic the *arr suite isn’t self hosted either since they rely on metadata cache servers.
In fact Jellyfin relies on external services for their metadata too!