1. Heroku will manage the underlying os and software, ensuring its all update and patched. We don't need to worry about the security of the bottom of the stack, that is their responsibility.
2. Backups, Heroku have a fantastic backup system for Postgres, it has already paid for itself. I will find it hard to move to any other system after they saved me after accidentally deleting half our db...
My only "complaint" about Heroku is cost, it is quite expensive for memory heavy processes (we have a few of these), jumps from $50 for 1gb to $250 for 2.5gb?! But the ease of use far outweighs that. Just hoping that there is a pricing update with more ram coming soon, I think its very overdue...