I don't think that's true. A home computer can be firewalled with no incoming connections allowed. Your VM in the cloud has potential attack vectors through your own control interfaces (http/ssh/pop/imap) as well as the hosting control panel. In addition it may be listening for incoming smtp. I might trust myself to configure all of those securely but I'm not sure.

You don't need to put it in the cloud. Just run it from inside your local network. If you want to access it from outside, you can setup a VPN.