There are not many differences in the codebase, since they utilize the same core.
Adobe Commerce does come with some modules that Magento Open Source doesn't. I can think of at least one case where an Adobe Commerce module was being hacked in the wild, but Magento Open Source users were unaffected since they didn't have that module.
Adobe Commerce users get access to pre-releases of upgrades 2 weeks in advance (See https://experienceleague.adobe.com/docs/commerce-operations/release/planning/schedule.html). This can give you some extra time to work on an upgrade.
With either version, there's a shared responsibility model for security.
- You're responsible for your coding (theme, extensions, etc.) and other configurations and customizations.
- You're responsible for patching and upgrading the Magento/Adobe Commerce software.
- You're responsible for ensuring that your overall website (not just the core) is secure and adheres to any relevant compliances, like PCI.
- You're responsible for any 3rd party integrations that you select and connect with your site and any vendors that you grant access to the site's hosting, admin, APIs, etc.
With Adobe Commerce, you get the choice of hosting with the Adobe Commerce Cloud. This is a managed hosting suite.
With Magento or Adobe Commerce On Prem, you choose your hosting independently, allowing. This can save you money, leave you with much more flexible architecture, allow you to host your other web resources with one vendor, open you up to more robust autoscaling, and leave you with much more comprehensive hosting service support.
If you select On Prem, you'll want to choose a fully-managed hosting provider that will include things like Malware Scanning, Web Application Firewalling, and Bot Protection, or you'll want to bring in experts that know how to set this up with AWS or other hosting infrastructure.
Best of luck!
