A fully managed VPS (ie. the owner doesn't install any software on the server, its all done by the managers) can be secured fully so its not the responsibility of the VPS owner.

But 99.9 % of the time, the owner of the VPS has the power to install software and scripts that can compromise the security of the VPS. So in that case, its a shared responsibility.

The host server security is always the reponsibility of the company that owns it, and they can't blame a hack of a hardware node on a VPS owner, thats crazy. A VPS can be fully isolated from the hardware and other customers for that purpose.

In a shared environment, you are never fully isolated from other customers so your security is always at risk. One other customer sending spam might blacklist your site just because you share the same IP. It might even cause legal trouble for you.

A VPS insulates you from the mistakes of other customers, but not your own mistakes