"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." - Theo De Raadt

But yes, you are right for the most part. However, just throwing apps in VPS doesn't automatically solve your security issues.