This is partly because shared hosting providers act like Internet slumlords. Their unwillingness to spend sufficiently to secure their hardware and users' data is not sufficient evidence to conclude that they are secure. (Honestly, at $4 or whatever a month, I sort of understand.)