I don't think that's true. A home computer can be firewalled with no incoming connections allowed. Your VM in the cloud has potential attack vectors through your own control interfaces (http/ssh/pop/imap) as well as the hosting control panel. In addition it may be listening for incoming smtp. I might trust myself to configure all of those securely but I'm not sure.