Especially considering that we are talking about a high-IOPs environment not a bulk-data environment. I've run MySQL's cluster system on 4 year old hardware with huge IOPs demand. All we did is max out the RAM, CPUs and replaced the spinning disk with SSDs. Adding extra nodes to up performance was trivial.
If they are in fact running their entire application stack in a single box. Then they are not being very smart. In this day and age not only can you tier your data and applications into separate systems to reduce your attack surface. You can put reverse-proxies and web application firewalls (like mod security) in place to detect SQL-Injection attacks before they even reach your app.