My thought is that anything you develop is only as good as your testing and dev skills. Realistically, if your server is fairly well patched and hardened, and you do some monitoring, you will see that 95% of the 'abuse cases' that hit your page are automated scripts that are blindly trying to exploit a six-month old vuln, a really sloppy web page, or are trying to enumerate a vulnerability on your server/host.
A real attacker would look at the same things you look at when testing....extra code laying around, vulnerable versions of services, mistakes made, etc. Of course if you're monitoring that closely, you can most likely see where people are poking around.
If you purchase a 'canned' solution, such as RSA Authentication manager or something like a Bluecoat reverse SSL proxy, you're doing two things, you're reducing your attack surface significantly (sometimes virtually completely), AND taking advantage of the fact that these pricey solutions went through LOTS of costly QA.
For example I've spent hours picking at the RSA ClearTrust authentication page code, on both the server side and from the outside...it's as solid as code can be, PLUS it's really hard to screw up the implementation, even if somebody has no real tech skills.
