You may already know this but, just to clarify... wordpress.com pages are hosted on their site, while with wordpress.org they provide the software to set up your own site using their publishing platform, on your own server.
If one uses wordpress.org, are they still getting the php and the security features built in?
It is the same program used, the only difference is in where it is hosted.