Even a fully-managed VPS will not always be fully secured by the host. The host will update and secure the hardware and make software updates that affect all VPS's. Beyond that it may take a trouble ticket from the VPS owner to have the host update and secure a specific VPS. You cannot depend on the host to do so without a request.

Of course, much depends on the virtualization software and associated control panel that's used.