If you follow the best practices and do not bind your onion service on 0.0.0.0 and use selfsign and don't reuse key, they do provide privacy against snooping exit node.
they do provide privacy against snooping exit node
onion services don't use exit nodes. Your client and the service build circuits to nominated middle relays so https only offers very marginal increases in privacy. However, you are right to assume than any exit node may (or probably is) monitored.
Since I never ran a hidden service I never challenged my assumptions that they connected to an exit node, but it make sense that an hidden service would be routed through a middle relay without going through an exit node.
Comments
If you follow the best practices and do not bind your onion service on 0.0.0.0 and use selfsign and don't reuse key, they do provide privacy against snooping exit node.
Good advice
onion services don't use exit nodes. Your client and the service build circuits to nominated middle relays so https only offers very marginal increases in privacy. However, you are right to assume than any exit node may (or probably is) monitored.
Since I never ran a hidden service I never challenged my assumptions that they connected to an exit node, but it make sense that an hidden service would be routed through a middle relay without going through an exit node.
Thanks for the clarification.