It's as secure as others promise it to be but actual security is in your own hands. I self-host vaultwarden but I keep it behind a VPN.

The logic is simple, Bitwarden is not there to detect intrusion attempts and safeguard your server so you gotta do it yourself, that's why its free.