A good hosting company will do server hardening, set firewall, file/directory access and other restrictions to the maximum level possible without interfering with the basic functionality of the server. They will also remove all services which aren't necessary but may pose a risk if they contain bugs (think of Bluetooth and USB drivers, fancy display drivers, RPC servers etc) and will add services or functionality to remotely monitor the hardware function of the server to jump in to replace hard disks or other failing hardware before you know something bad was happening.

all necessary software will need configuring and installing as well. apache and virtual hosts, (php/mysql probably), sendmail and virtual email accounts, ftp server and accounts. i've done this a couple of times and it's a real headache, albeit a good learning experience. depends whether you have the time or knowledge.

although i've never used something like cpanel or plesk, they can do a lot of the above for you.

Having done it in the past (not at the moment) I intend to stick to shared hosting as long as I can because of the extra work involved.

I currently run some sites on a shared host that lets you run your own server instance, so you can have custom config.

Some VPS hosts have images that match your requirements: some even have easy installs of a particular framework.