It stops at the first match. So you can permit a few machines ftp or telnet access and then deny access to everybody else in hosts.deny . Now we want to disallow access for evrybody else. The answer is any machine that is publicly accessible is necessarily unsecure and vulnerable to security problems. So we should take proper steps to minimize the vulnerability.
Physical security is the first layer of security.
If you are a home user, you probably do not need to worry about this too much. If you are in a public environment, you must be far more concerned about this aspect of security. If users can reboot your system, it is trivial to manipulate the data on the system. Whenever possible limit user access to the console. An important one is not to allow root log-in from any terminal except the console.