It's because hosting services have access to your server while setupmasternodes doesn't require access at all. They teach and guide you through setting it up. I've heard stories of people getting their coins stolen just because someone had access to their server. Plus, it's a $50 one-time fee whereas the montly $6-9 can add up and cost more in the future.
If the MN is set up correctly and controlled remotely, noone can steal the funds. I don't think they could even redirect the new payments anywhere.
In order to have them stolen, you need to have the wallet accepting the payments be in the MN itself. That is bad practice.