It’s software, everything can be done. Even if username and passwords are not kept in plaintext as you suggest (and likely nobody would do)

Problem is that the number of people that self host password repositories is so little that it makes no financial sense. And so for this reason your “massive scale” is an hyperbole because there isn’t a massive scale of people that self host password repositories

Botnets that stole from local password repositories makes more sense because there are more people that use password managers of sort.

Humans looking are flexible enough to look at all possible long tail cases like this… but not going to happen except for high profile targets.

All in all what i am saying is that i don’t see clear evidence that self hosting is more dangerous (in practice) than centralized hosting