Database and Web Server on the same machine?

Just a thought of having separate servers for database and web landed me on the following links:

• Why is it not advisable to have the database and web server on the same machine? – Stack Overflow
• Should SQL Server be on the same machine as your IIS installation?

My catch:

Single Server

Pros:  Performance gain, less latency time

Cons:  Vulnerable

Separate servers  

Pros:  Security advantage, scalability

Cons: Expense on extra hardware

More on this soon!