Bitcoin Piñata hosted 10 BTC for three years, so I think substantial security is possible. It had one known vulnerability (in network device driver) patched before exploited in its life, and zero exploited vulnerability (BTC is still there). Obviously we can't know about unknown unexploited vulnerability.