True. But a simple server in a closet hosting only your data is less likely to get the attention of a determined attacker. I guess the argument is similar to the Windows vs Mac security argument in that one may be more secure but the other may be safer for most people because of the incentives and economics at play.
If the setup becomes standardized, though, bots will roam the net attacking the setup rather than you personally. It'll be like running your own Wordpress.
