"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes." - Theo De Raadt
But yes, you are right for the most part. However, just throwing apps in VPS doesn't automatically solve your security issues.
Having 2 completely separate VPSs, in different data centers, secured with different passwords, seems pretty much more secure than having a single server to me.
Yes, there could theoretically be a way to punch through from an insecure VPS into a secure VPS on the same host, but I think the chances are pretty slim there.
It's wonderful for redundancy as well. I recently migrated our DNS from two dedicated servers in the same data centre, to three $20/month VPSs all on different continents. I don't need power or bandwidth, what I need is super-redundancy. These new VPS deals just hand it to me on an ultra-cheap platter. Couldn't be happier.
But yes, you are right for the most part. However, just throwing apps in VPS doesn't automatically solve your security issues.