My only nit with your nit is that the security you are attributing to WordPress is more inherent with PHP and exists in any PHP-based CMS, including Drupal. Hate to be the guy that keeps defending WordPress but the problem is PHP and Apache and those file permissions... not WordPress itself. ;)
WordPress.com is a great service and you can get a lot of the same "stuff" that we offer. Obviously, they've been around a lot longer and have a ton of experiece.
WordPress.com has, essentially, two pricing structures - free and custom pricing starting at $500 for VIP customers. They make a ton of money in upgrades, as you noted.
They don't give you access to the files, unless you're VIP, and then you're still limited. You don't have access to plugins of your own choice. The freedom that you have with WordPress.org (self-hosted) doesn't exist on the theme, plugin or user side. But you get an amazing architecture, with almost no downtime, and a crack staff that knows WordPress inside and out.
WP Engine targets an entirely different market. We're targeting self hosted WordPress and trying to provide premium value for premium blogs. You couldn't take my blog, for example (http://technosailor.com), and put it on WP.com. There's too much I've done with it for it to make sense even if I bought the Custom CSS add-on. I can put it on WP Engine (and do) and get all the stuff that is offered.
I don't know if I'm making sense. I hope I am. Certainly, we are still honing our messaging.
One big bonus that no one else will give you is free CDN. If you need it, you're going to start at $40/mo roughly. And maybe pay up to 20 cents/GB bandwidth. I think you can see where this, essentially, pays for itself.
Plus, we are working with Automattic/WordPress.com and our customers should be seeing the benefits of that soon. Stay tuned. :)