Reputable VPS provider is important. Sometimes small, but serious, providers can offer better security. Consider dedicated server - quite often, especially with not-so-new hardware this can be on-par in terms of price. Keep OS and CRM itself updated and address these questions to their developers - at the end of the day it comes to the code that you run - if code allows - all kind of things might happen - it's way more likely there is a bug in CRM, than VPS provider is hacked.