OK, I'm confused, explain how they can deliver comparable security on a hardware that does not offer the same capabilities, from a vendor who doesn't provide patches.

You say they can. How?