It is surprisingly very durable and maintenance-free even for a script kiddie like me to maintain. My advice is (at least when it comes to Vaultwarden) don't think too much about this, just selfhost it, at least for yourself. You'll probably be able to manage it when something happen.
and not using their official clients,
your database stays functional in perpetuity.
My host has prebuilds for Vaultwarden.
The API for managing secrets automatically is gated behind `bitwarden-cli serve` which is surprising for me that I can't call the API directly using urllib or requests directly. I have to pass it through the bitwarden-cli.
I've been using bitwarden for a while, but your comment prompted me to investigate how I could backup my secrets, and this is a surprise. I am considering moving to my own infrastructure, because I dread having to depend on this tool to automate regular backups for me. Better to do that at the service layer. Problem is just how to expose it. There is always tailscale but that's just shifting the problem around.
Automating this definitely seems like a bad idea, but it depends on where you're putting the backup. I put mine into encrypted, offline storage and thats not something I want to keep connected all the time for a cron job. That, and you're dealing more moving pieces (CLI with vulns like you mentioned) and automating access to your vault.
Theft is also usually obvious.
If self-hosting, keep at a separate location than your hard drives.
Reimplementing the server side is the easy part.
But a commercial offer will need rebranding the client, and maintaining forks is much more involved. As long as Bit warden publishes the sources ...