Unless they prove them self or have someone as a security expert, it will be much safer for them to use shared hosting rather than a VPS/dedicated server.
Why is that? How is shared hosting safer than VPS or a dedicated server? I don't know much about these things but I have been told that if you have a shared hosting account your site is more or less only as secure as any other site sharing that server.
If the file permissions (and DB's) are set up accurately, then security can be as good as other options.
With shared hosting you can never have a busy site, that is a huge issue.