I have a pet project up and running on DigitalOcean but my god, it's duct-taped to hell. I don't even know how to apply Nginx patches as they come out without bringing down the website. :(
Thanks Heroku for sharing!
I'm not sure what kind of stack you're running on Heroku, but if it happens to be Ruby, Heroku won't do anything (AFAIK) to update gems specified in your Gemfile.lock file when vulnerabilities are found. That's still up to you, and security issues in gems appear to be far more common than those in parts of the infrastructure that Heroku does keep up-to-date.
Sure, they have a better, larger, ops team than most orgs, but they also need to run a much more complex product. I think its a wash IMHO.