You have to trust a third party company either way, so I don't think you're closer by having the domain, from a trust / vulnerability standpoint. In fact I think that email is best hosted by specialists with experience - and I'm saying this after hosting email for quite some time.
Domains are much less of a wild west than accounts at a mail provider. Whil you do need to go through a private registrar, that registrar has to follow certain rules including letting you transfer the domain to another registrar.
This is a good reason for not using any of the new vanity gTLDs though as they can make their own rules unlike old gTLD (which are regulated much more closely by ICANN) and ccTLDs (which are regulated by the corresponding country).
The domain situation is something that I don't have a good understanding on, and part of the reason why I outsource the responsibility to a third party email provider - namely that they will do a better job protecting their own domain, than I'd do protecting mine.
I understand that some domains carry some legal attachment. That the new vanity domains are not as trustworthy as others, some are even filtered, as email validators reject it for not being a "valid" address even. Some TLDs need to have a business registered on a location, etc. And I understand that the oldest ones (com, org, net) are among the most universally accepted. But I don't know what carries greater risk: 1. me losing control over my domain, or 2. me losing access to my email account (Posteo in particular - I wouldn't just trust any email provider).
