Django is only a framework

Much of the less interesting things like security features (think CSRF or salting passwords) have been taken care of by experts.

Frameworks also promote best practices (this is especially true for RoR) and take away the hassle of dealing with a database by providing a nice ORM layer.