Providers may supply caching, backups, staging environments, monitoring and automated updates. The exact responsibilities differ by plan, so the word managed does not by itself define who updates every theme, plugin or server component.
WordPress is written in PHP, which means its security also depends on the PHP runtime selected by the provider. A WordPress dashboard may show the PHP version but cannot always identify the distribution-specific build or security backport that the host has installed.
A hosting provider might patch the server runtime while the site owner remains responsible for vulnerable plugins and custom code. Conversely, updating WordPress does not correct a flaw in the underlying PHP interpreter.
During a PHP advisory, confirm the active runtime and patch status with the host. Maintain a clear division of responsibilities for WordPress core, extensions, PHP, backups and recovery testing.