You're right, but you're talking about application security, not the security of the infrastructure itself. For most endeavours, it's enough to have a securely written app hosted in an average data centre. When you're looking after currency, there's so much more incentive for people to break in, and you have to put some extra resources into securing your infrastructure too. By the sounds of it Bitcoinica has completely neglected to do this and has been operating as if they were just a startup storing my cat pictures on S3.