The confusion here might be around the term "self-signed". Technically, all roots are self-signed—that's the definition of a root CA!—but in this case the user just means "self-signed" as in "signed by me, not signed by some commercial third party". "Self-signed certificates", though, usually refer to certificates with no PKI chain: the device created a single certificate, signed it with its own key, and then just distributes it to create trust without the usual hierarchy of a PKI.

The attack on that latter system is that you as the client have no basis on which to trust that cert when its first presented. So an attacker who can intercept that first presentation of the certificate and replace it can MITM the traffic flow without you knowing. Worse, most devs "fix" that initial trust problem by telling the client not to validate the cert when its presented (because they wouldn't have any basis for doing that anyway), so an attacker is free to inject their own cert into the traffic at any time.

Using an actual private PKI hierarchy helps fix this: you create a root, and get your clients to trust only that root. Now you can issue your own certs, and an attacker can't MITM the traffic unless they can get their own cert from your CA. That's the same model as is used with commercial CAs: you're just operating the root of the chain yourself instead of paying someone else to do it.