[richmarr]

Speaking from the perspective of someone getting small projects off the ground, the value of Heroku (and similar) is that they help you stay focused on dev rather than ops.

In your example of security, you take an increased risk due to attacks on shared services, but I'd suggest that only a small fraction of "production" apps can field as qualified security teams as Heroku can provide... so if Heroku's customers all moved to EC2 there'd be an increase in badly managed and unpatched instances.