Having a node/wallet system adds some small measure of risk, while removing a high measure of risk. On balance, the separated system is more secure than a monolithic system.
If you consider the separated approach, there are three points that can be attacked: the node, the wallet, and the link between the two.
If the node is compromised, then it doesn't have access to the keys, since those are in the wallet. Any malware must still compromise the wallet first before getting access to the keys. Access to the node allows you to degrade the wallet's privacy to some extent, though most of that venue was removed with Monero 0.10. See What privacy or security trade offs are associated with not running your own full node? for details. If you had a monolithic architecture, your keys would be compromised already.
If the wallet is compromised, then both architectures have your keys. There is still a chance with Monero though, though a slight one. If the VM running the wallet only connects to the daemon VM using a very strict firewall (obviously not one running on the wallet VM, but something enforced like Qubes OS firewallVM), then the wallet might have to break out of this jail in order to exfiltrate the keys. However, the wallet can probably send normal transactions anyway, so it's a 90% break instead of a 100% break. Close enough. Note that I don't consider the case where the wallet is air gapped. In both monolithic and separate cases, you're still good.
The last case, which is the one you're refering to, is when the link is MITM'd, which can be broken down into passive MITM and active MITM.
Passive MITM can't do anything else that a daemon compromise can't do, since the daemon can trivially MITM itself. You can gather information, which is not much since Monero 0.10. Active MITM can additionally DoS you, and feed you wrong blocks, so you think you're up to date, but aren't. This still can't get to your keys or coins, though it can make you think someone sent you money. Depending on the nature of that active MITM malware, this can probably be done to the monolithic appproach as well: if the malware can intercept and rewrite/withhold/add packets on the network, the monolithic node will also get fooled. The only way I see where risk could be added is if only the node/wallet link can be compromised, without the rest of networking being compromised, but that sounds pretty unlikely.
So, in short: Crypotonote/Monero's node/wallet architecture increases security, rather than the opposite, for all the reasons stated above.