This is a bit of a nebulous one, sorry if it's not specific enough but here goes.
I currently manage a bunch of wordpress sites which often require a set of custom post types & fields. currently this is achieved using ACF Pro & the Custom Post Types UI plugin - though i've used Toolset Types in the past- tomato/tomato
When I make the move to live from staging, I tend to just leave it as-is in case the requirements change, which they often do. What i'm asking is, is there any performance / security / other benefit from actually just exporting the code for these bits into the theme, in functions.php or similar? or is there nothing wrong per se with using this kind of plugin in a live environment? my end goal is more security and speed, and while there's loads of other things which affect this i'm interested in this aspect in particular.
One of the main benefits of transferring your logic to your theme files is that you can see changes and updates in your version control, because when you use ACF and CPT UI plugin, all the changes will be reflected in a database and as you know there is no easy way to version control database.
Also instead of every time you open a web page, WordPress does not need to go to database and see what kind of post types you have registered, so this could be considered as minor performance benefit.
If you use ACF, you can also utilize ACF local JSON functionality
This saves all your custom fields schema into JSON files on your server and you can see all the changes made to custom fields in your version control/backups, etc.
It's not wrong to use these plugins on live site, especially ACF, as it helps you to display and query your custom fields in a more comfortable way, but you want to have an ability to version and backup your changes.
As for CPT UI, you don't really need it's functionality after you created initial structure of you custom post types and it's only additional plugin to update and query the database every time you load your admin panel. Also you can never be sure if plugin will have some vulnerability and considering security factor you always want to keep amount of plugins to a minimum.