WordPress.com is more secure out of the box. This security is primarily due to the level of control that the service places on users. For example, stopping most users from installing plugins reduces security risk significantly.