This boils down to two simple questions,
- is one layer of security enough?
- is any piece of code ever bug free?
SuHosin provides an additional layer of security, on top of your already secure application, to cover those inevitable instances where you do have gaps in your own code.
No piece of code is 100% secure, because no piece of code is 100% free of bugs, and who knows how those bugs can be exploited.
Additionally, you don't know what bugs or vulnerabilities are present in PHP or the PHP modules you use. SuHosin may protect you from those as well.
- One layer of security is usually not enough.
- No piece of code is ever bug free.
Whether you use it is a personal choice, a mixture of,
- what's the impact of exposure on my site?
- what's the overhead or complication of using SuHosin?
You trade one against the other, high impact and low overhead = go for it, low impact and high overhead = maybe not bother.