Self-hosted means you control your data, though it certainly leaves you open to more attacks if it's open to the internet, but you can always protect it by hiding it behind a VPN. Having financials available everywhere is very convenient, and not having data on a mobile device (but accessible on your mobile device) is great for privacy-concerned people.
I've since stopped using even the 'manual import' and I've found that reconciling to my bank/financial-company statements manually is much easier overall as importing auto-reconciled transactions but then it was basically impossible to then match any specific balance reported by the bank/financial-company.
Edit: PHP is actually in a pretty good state right now, so I think it's a poor criticism, but probably a common one.