There exist documented malware exploits that have targeted VMS.
There are known vulnerabilities and security weaknesses.
There are issues with passing security audits with the web-facing VMS tools. (eg: You likely won't pass a PCI audit without additional security measures.)
Is VMS secure? Probably. This if you have a firewall, and if you manage your servers and stay current on updates and security monitoring and settings, and particularly if you're a low-value target. One that nobody cares enough to attack.
If your servers comprise a high-value financial, political or military target akin to what some recent malware was aimed at and if you're depending on opinions garnered in this forum for your security policy, well, you're toast.
