I've audited both WHMCS and Solus. I found a half-dozen bugs in minutes of looking at each codebase. I can't express how horrible this software is that 90% of these hosts are running on - they are both an absolute trainwreck. More hacks are only a matter of time, especially when neither company responds to emails or security incidents well.

How much real engineering are these providers doing? How well do they understand their stack? If they're all running the same underlying software, it suggests that setting up such an operation doesn't require much skill and it's heading to "script kiddy" territory. Sketchy? Certainly suspect and needing a lot of due diligence which my gut tells me that (a) they won't fare so well; and (b) they are so low-margin that they would be unwilling to participate.

If Apple got hacked because their dev center was powered by a $10 control panel script then yeah... they'd be extremely sketchy too.