Ideally, such an install should include updated and patched versions of all apps in the stack. However, many security holes are introduced by the code being run

Ideally, such an install should include updated and patched versions of all apps in the stack. However, many security holes are introduced by the code being run on the stack - for example, writing a web app that is vulnerable to SQL injection or cross site scripting(XSS). Since this code is written or added post download, its not possible to pentest it pre-download. So it is still up to the dev to sanitize user input, use parameterized queries, not run the database as root, etc. So for apps requiring a high degree of security, a pre-release pentest is a good idea. Please see: https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php https://stackoverflow.com/questions/60174/how-can-i-prevent-... for more.