Just check out the masternode guide on https://rupeeblockchain.org/pdf/rupdoc.pdf when you create a masternode first you have to send  exactly 20000 coins to a new generated adress in your own wallet. So the coins will never leave your own wallet. The masternode on the vps only needs to know on which wallet address he must run. The blockchain will check if there are still 20000 coins in the wallet to keep the masternode running. So you can always send your coins from your own wallet to an exchange if you wish but the masternode stops running at that point.. so you are always in full control of your own coins. When the masternode got hacked or something like that they cannot harm because they cannot get your coins. If something like that happens ( i never heard someone facing this problem) you just delete your server on the vps and create a new one.

If you have more questions i am here to help you out.