It's a common misconception that the web hosting provider is responsible for the website's security. The provider only protects the server your website is located on, not the website itself. Think of it as securing an apartment building. The property management is responsible for securing the building, but each tenant has to lock the door to their own apartment.