I think Google might just be calling block lists “externally hosted code”. As I understand it, there are several restrictions: the severe limitation on the number of rules, the requirement to bundle rules with the addon (and the associated delay due to extension store review), and the loss of many advanced rule types that change blocking behavior based on different factors in order to avoid detection and otherwise be effective.
The ublock FAQ has some interesting details too: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#filtering-capabilities-which-cant-be-ported-to-mv3
I’ve done a backup swap with friends a couple times. Security wasn’t much of a worry since we connected to each other’s boxes over ssh or wireguard or similar and used tools that allowed encryption. The biggest challenge for us was that in my selfhosting friend group we all prefer different protocols so we had to figure out what each of us wanted to use to connect and access filesystems and set that up. The second challenge was ensuring uptime and that the remote access we set up for each other stayed up - and that’s what killed the project as we all eventually stopped maintaining the remote access and nobody seemed to care - so if I were to do it again I would make sure all participants have alerts monitoring their shared endpoint.