WordPress.com is a closed space where everything comes pre-secured, you don’t really have to worry about security, the system is locked down and you yourself do not have the authority to make your site vulnerable. There are some WordPress Security Practices that you must definitely follow. In WordPress.org however, you will have to be responsible for your own website and implement security plugins. There are many WordPress security Plugins and installations available that you should definitely look into handling security better with WordPress.org as the entire content goes on stake. WordPress.org also lets you monetise your site in any payment integration method you want to apply. WordPress.com is limited in that sense.