cpanel has a loooooong history of security issues. It's probably the single most vulnerable part of any hosting company's infrastructure. ISPConfig is probably better, but it too has had some issues (
http://www.exploit-db.com/exploits/29322/).
There's a fairly low bar for system administration for "just getting it to work", but a really long upward curve from there to "properly managed". For example, backups (which typically require some special handling for Postgres and MySQL). Also, if you store any user data at all, you're kind of obligated to make sure it's safe. You kinda want to have automated DB backups and data safety even if you're using Heroku, but doing your own sysadmin might add to the effort required to get it all working right.
You're right for the most part that you're not likely to see much in the way of targeted attacks, but be careful not to discount the number of automated attack systems that are out there now. Within a minute or two of bringing a server online, I begin to see hits for spam, ssh, and root password attempts from around the world. It's sort of amazing really. None of these are likely to go very far on a default install, but if for example you decide to set up an MTA so that your application can send you (or your users) email notifications, it's easy to goof up a sendmail config and end up with an accidental open relay.
Maybe another way to put this is, Heroku charges that much because they provide that much value to people who don't want to deal with this stuff. I prefer to deal with this stuff myself, but a lot of other people don't, and I can't say they're wrong.