Neither is necessarily more secure, but I will give you some opinions and perhaps facts.
Host-extract can determine hostnames, which is also possible via virtual host enumeration.
DirBuster, skipfish, and fuzzdb can rely on forced browsing, directory indexes, and predictable resource locations to find vulnerable directory structures and other issues. Spiders and crawlers can traverse directories, and certain ones can also traverse hostnames (I know that skipfish is capable of this).
In some ways, virtual hosting is more difficult to manage (you mentioned SSL, which is a great point). If this is easy for you to manage, it may end up being more secure because of the ability for directories to leak much more information than hostnames, and to be vulnerable to attacks such as XSS much more easily (as @Rook describes in his answer).
Usually this is never up to a security professional, or security team. It's up to the developers, marketers, and SEO experts. They decide what gets a hostname or a URI structure. I will research into this topic further and update my answer as I get new information. It's an interesting question.