"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." - Theo De Raadt
But yes, you are right for the most part. However, just throwing apps in VPS doesn't automatically solve your security issues.
Having 2 completely separate VPSs, in different data centers, secured with different passwords, seems pretty much more secure than having a single server to me.
Yes, there could theoretically be a way to punch through from an insecure VPS into a secure VPS on the same host, but I think the chances are pretty slim there.
It's wonderful for redundancy as well. I recently migrated our DNS from two dedicated servers in the same data centre, to three $20/month VPSs all on different continents. I don't need power or bandwidth, what I need is super-redundancy. These new VPS deals just hand it to me on an ultra-cheap platter. Couldn't be happier.
The security is just an added bonus.
Instead of having a single big kick ass dedicated server running everything, you can have maybe 10 VPS's each doing a different thing. You can group things together in terms of risk - put wordpress on its own vps, put your customer db on another, etc etc. At least then, if someone hacks into wordpress, it doesn't really matter that much - they only get wordpress, nothing else, and you just clean off that machine from backups.
(Obviously have completely different login credentials for each VPS, and only grant access from one VPS to another when really necessary, and restrict it).