If you set up your system so that only the guest listens on public network ports (those that are open on the firewall), then you win security in the sense that if someone manages to get into the guest and do some damage, it can be repaired more easily.
Another advantage is that you may be able to limit the guest's resource usage, maybe even kill it off and restart it entirely if it misbehaves; while this cannot completely prevent a resource-based DOS attack, it can at least minimize data loss and downtime.
Yet another situation where this may be useful is if you're running a shared hosting service: by running several virtual servers on the same physical machine, an attacker can only compromise one VM at a time (even if they gain root access), unless they manage to break out of the VM and compromise the guest as well. By comparison, if you have root access on a traditional shared host, you can access all the websites it serves.
Other than that, though, the guest is just as secure as a physical server: if someone breaks into it, your data is exposed just like it would be on a physical server.