I have huge respect for PHP, and many years of PHP development under my belt. I wouldn't dream of using it for something pretty heavy weight such a this. Certainly a factor that would come into play for some prospective users.
A VPS introduces many layers of possible weakness, that could be used a entry points for an attack.
PHP just isn't the right tool for the job. I agree with you, that at this point in time it's secure. I trust that other languages, with smaller, simpler code bases will be more secure over time.
If you mean the purpose of the app, PHP is more than capable of handling highly sensitive data if it is written by a capable developer.
If you mean traffic wise, a single VPS can easily handle thousands of requests a second, and if you need more you simply add more inexpensive VPS.
Unless I misunderstood your sentence?