Keeping even just one server secure and up to date is no small task. Additionally, in this particular case, given Gitlab pushes changes pretty often, we wanted to have access to the latest stuff without having to update the self-hosted instance every time (with the added risk of screwing up in the process). I guess there's a trade off for everything.