> I'm pretty sure WP Engine could patch Wordpress to use its own infrastructure, so this isn't a really as much of a security risk as people claim.

Patching core WordPress is straightforward, but there's also tens of the thousands of plugins and themes on WordPress.org. Until WP Engine can create a mirror of the plugin and theme repos, there will be security risks.