So instead of a third party, I'm expected to install and run my own syncing service on the open internet and all of the security patching/monitoring is up to me?
I'd still want E2EE for that since if someone breaks the syncing service they'd have access to all of my notes.
Yes. And not sure why you're dramatizing it so hard, the best security/patching/monitoring comes from free and open source software, and the biggest fails tend to come from third parties that I (or more importantly, everybody else) can't monitor.
This is all the whole entire point of software freedom. It's not that it's perfect, but it is as good, frequently better, than third parties. Weird how this is controversial.
Try syncthing. But if not that, I mean, rsync, which is what the big boys rely on anyway.
I'd still want E2EE for that since if someone breaks the syncing service they'd have access to all of my notes.