The risk of being attacked is the same but
any decent provider that does some kind of mass hosting should have appropriate infrastructure to deal with attacks. That means your upstream should be more reliable (but the same is true for any provider that cares about it's own infrastructure)
There's no way anyone can survive a DDoS attack (given the attack is sufficiently large). Basically it boils down to infinite resources vs. finite resources.
Simple example:
Your provider has:
- a full 10GBit/s line to every server
- Servers powerfull enough to saturate the link
Attacker has:
- total bandwith of 5GBit/s
You can (in theory) survive the attack, in contrast to
Attacker has:
- total bandwith of 12GBit/s
there's nothing you can possibly do. If the attacker just sends a simple SYN-flood attack to you webserver you can't react to the attack because there's no way for you to log in over the line, it's already saturated (assuming it's the only way you reach that server).
SYN flood protection won't help because the 12GBit incoming will simply saturate the 10GBit pipe by sheer amount of data (hell 12GBit of SYN packets with no payload that has been sent yet is a lot). Especially when there are thousands of boxes and not 2 or 3 boxes....
iptables won't help you because by the time iptables can take care of the situation the pipeline of your network card is already full.
The only thing that will help is someone upstream that can cope with the incoming traffic to block each of boxes sending requests, but I doubt that with a cheap VPS (even if it's a few hundred bucks/month) anyone will care to take measures because of your VPS. They will only care because it hurts their own infrastructure, probably they'll just take your VPS offline so that the attacker thinks he or she has reached the goal and stop attacking early.
Keep in mind that with a VPS you are still affected by attacks to another (possibly completely unrelated) VPS on the same physical server. By using a physical server you'll at least be only subject to attacks that are targeted at your customers not some random customer of your provider that happens to be on the same physical host but in another VPS.
(I'm tired and english is not my native language, I apologize if none of this makes sense)