Varnish passes requests through to the underlying site (in this case Wordpress), which doesn't make it any more secure.

If the cache were fully populated (e.g. by spidering the site) and never became stale, then it would be roughly equivalent. Still, I'd rather disconnect Wordpress after spidering, so there's no chance of requests leaking through.