Custom module/plugin development lets you extend CMS functionality beyond what's available...
Drupal and Joomla, like any CMS, need specific security hardening beyond generic VPS security...