FYI, this is called "split horizon" DNS, where the location you get directed is based on the network you adk from. Make sure you have short TTLs set on your DNS records, or devices can have problems moving between networks and still having records cached from the prior network

For the $5 first payment, they have a partnership with Snikket who will setup and administer a private XMPP server for you. It's included in the price if service and is retained for as long as you maintain a server. You can use it for any XMPP thing you want, and have as many users on it as you want.

Privacy friendly Ente has an E2EE cloud backed up authenticator app called Auth. In case you didn't want to host your own, or need multi-device sync.

Or you can just self host Bitwarden and use the built in 2FA that can be attached to any login

When I install this snap am I getting a kernel driver, a native raw binary, or a containerized user application that conforms to a communication interface? Who knows! They're all mostly undifferentiated in the store.

What about a third party store? Only if you fork the snap daemon and change the hard coded URL. And good luck with that mandatory Canonical contributer agreement you have to sign.

Want to pick when your apps update? Nope. That's the official stance. They will never support that. But here's a way to manually block network access to the daemon if you really really need to. But then everything will update at once when you give it access again.

Want a specific version of a snap? See above. Explicitly will never be an option.

"I guess there's a fee to pay to get access to quality apps." Incorrect. There is no real vetting process for what's added to the store, there's barely even minimal checking that you're not overwriting someone else's snap. You do have to sign the Canonical contributor agreement, and setup an identity to submit as, but even if your snap is proven to be malware there a good chance it will stay in the store, or can be immediately re-uploaded.