At the risk of upsetting your other responders, I take exception to many things in this thread although primarily your reliance on a canned app (CMS).
First, WP is a good, mature, canned app (CMS) which is routinely updated ... because hackers have access to the code (some even offer addons?) and they work at finding new ways to circumvent its protections to routinely hack WP websites. Worse yet, they post their hacking how to's and the "script kiddies" get involved to rampage through WP websites - it is simply a race for WP to receive reports of the hacks, find the attack vector, develop a patch to prevent that attack and for clients to update their websites before being hacked! IF you check daily for WP updates (and avoid addons not created by WP), you'll only spend a few hours updating EVERY WP installation you have rather than rebuilding entire websites. I admit to setting up a few WP websites for clients but warned that they have to check their admin panel for update notices DAILY and update immediately (which has not been a trivial effort ... although WP has gotten better with their updates).
VPS? I've had shared, reseller, VPS and dedi accounts as well as procuring a "specialty account" for a client who insisted on having the bloated CPU and RAM necessitated by Drupal.
WebHostingBuzz is the only host I've found with "specialty accounts" (including WP) which limit the number of users who share the CPU and RAM; one or more of these may be the optimal account for you.
Shared and reseller accounts are okay but can be highly restricted by the host because of the number of clients sharing the server.
VPS accounts are typically very limited in RAM and CPU time (probably much better than shared but I have no basis to compare with "specialty accounts") and are relatively quite expensive when compared with the lesser accounts.
The dedi account is the most expensive but you can have your host configure what you need (and change the configuration as you grow or shrink your client base; VPS, too, more often than not).
Both VPS and dedi should be managed by the host (you won't have the expertise of their support staff, you won't have their server tools nor direct access to the server, you can't manage the interface to your VPS/server in the face of a DDOS and you can't possibly monitor the VPS/server 24/7/365¼. Cutting the management corner is a sure route to disaster.
Cloud? From my limited exposure to them (looking at their prices and running away as fast as I could), I can't recommend them. Cloud hosts like Amazon may suit a large operation which must have a 24/7/365¼ uptime but I doubt your clients are in that class (and doubt that they would pay the increased cost).
My recommendation is that I don't believe you need a dedi (yet), that VPS is overpriced for the share of the server which is yours and that a reseller account would be most appropriate for you except for the CMS which, IMHO, forces you toward one or more "specialty accounts" (to ensure the CMS CPU/RAM requirements are met for each of your clients).
As for your "... install anti-virus", that would have make me run from that host ... immediately!
Hosting Recommendation? I've changed hosts over the years and am currently running a pair of accounts (the Drupal client moved on; I have both a shared account and a dedi server) with WebHostingBuzz. I have been with them for several years and am thrilled with the prompt and efficient service from their support staff. Additionally, they have top of the line hardware so there has been only one or two very brief interruptions in service over those years.
Others? WebHostingZoom was a good host whereas Site5 was superior at the start then changed management (badly degraded service) before Ben (a visitor in this board ... in the past) took over and was trying to restore Site5 to their former glory.
Anti-Recommendation? I'd been the Hosting Team Leader here for a few years and can only say that registrars (GoDaddy, etc) had excellent reputations as registrars but seemed to ignore their hosting clients (provided lousy service and extremely poor support). I'm not sure what bucket 1&1 fell into but they were always being roundly criticized. I'm sure that there are others to avoid, too.
I hope that no one takes offense at my comments as none were intended. Just giving my :twocents: worth.