You don't need to ssh into the box to take care of Rails vulnerabilities; just redeploy. Heroku is taking care of any vulnerabilities in the rest of the stack: Postgres, Nginx, SSH, etc.
The thing you need to test then deploy are upgrades to your language and framework/app, and those present exactly the same problem on heroku or on say a vps. You can't just redeploy your app without testing on a new config, and deploys to heroku are no easier or harder than deploys to your own server once set up.