I'm at a public University in Europe and can say that we do occasionally rely on third parties, but only such third parties with which we have an appropriate contract.

We also have self-hosted equivalent for almost everything and a quick email to the data protection officer will get problems rectified swiftly.

Most student organizations are also very mindful about not using third party services for their events. However, we often get the feedback that many students would rather we just use Discord rather than Mattermost/Jitsu/...