It seems like they still struggle with Security exploits--It's not a perfect system. For example:

https://blog.heroku.com/archives/2013/1/9/password_hijacking...

Also, you could get pretty solid protection and faster response time with something like unattended-upgrades

https://help.ubuntu.com/community/AutomaticSecurityUpdates

I think the value proposition mostly lies in the autoscaling, but seems like a waste in aggregate since most apps never hit any sort of scale.