If Saylor entrusts someone else to keep such a large amount of BTC, then we can conclude that he does not understand Bitcoin to the extent that he tries to show it to the public. According to the statement posted by @witcher_sense, we see that even last year they were aware of the risk arising from the custody service, and it would be strange if they did not do something about it.
The extra bit of information I have from my source, who is currently not available for personal issues, is that, yes, Microstrategy (or Macrostrategy) is actually doing self-custody.
Of course, they have an elaborate system to avoid the loss of private keys (details of which are obviously not known to him), with multiple levels of security (whatever this means).
The sentence on the 10K form might be related to the bitcoin they purchased via the Lombard debt issue, and their bitcoin used as collateral for this. Those Bitcoin actually are not under direct Microstrategy custody, as far as I understood.