You have to trust the VPS proviider as he can easily copy everything from your VPS, he can clone it etc. And they can also sniff the network traffic
Yes picking a good VPS provider is important, and that is a flaw with email. We could re-word your statement as "Email isn't good for active threats, but if the provider wastes money, then information can be obtained" However, you do not present an alternative.