They can't secure Wordpress for you. You still have to do that yourself. Wordpress plugins are chock-full of holes, probably the biggest attack surface this side of Windows XP.

In a lot of cases with the 'hosted' platforms, you're limited to a handful of 'approved' plugins that have been vetted and are kept up to date for you. So... you're getting protected, but losing out on one of the primary reasons people choose WP in the first place - customizability. But it's not the reason everyone does, hence the hosted places can still thrive.