I think that this article failes to see the main problem, which is the failiure to protect your data from your CMS. Sure, I run wordpress on my VPS, but my VPS has NO access to my data. My VPS is UNTRUSTED!

-----

One thing that is problematic with the untrusted model, is that I also run my mail server on my VPS. Email is insecure, it is unencrypted as it travels through the internet. Unfortunately, I cannot do much about that fact. I should however, be worying more about separating my email server from my wordpress installation than about making sure that my wordpress has no security flaws. OF COURSE the wordpress could be hacked, even though I always install updates on time!