Security (general lack of user-land and in-ability to run more than one program), server density (run thousands of vms/box).
Most attacks aim at executing arbitrary code in the process space of the application being targeted. The lack of user-land does not help.