If you are going to buy a premium theme for WordPress (or any theme/template for any CMS), you are better off buying one from a developer who has a track record of updating the theme as WordPress evolves. This doesn't just apply for premium themes...when assessing free themes, check the changelog for the theme and see if the developer releases regular updates.
Themes do not get hacked all that often and when they do, it's because they bundle in functions that would otherwise be added as plugins in an attempt to make the theme more attractive for sale. These functions need to be tended to as if they were actually plugins, so as WordPress security evolves, so must the theme in order to stay secure. The other big security problem with themes are the free ones you get from random web sites (e.g. not wordpress.org or known-good developers) that may contain all sorts of backdoors. If you don't know the reputation of the theme developer and the themes are not on wordpress.org's repository, stay away.
As far as who you buy your theme from, that's really an opinion question and fairly hard to answer. However, whenever you pay for something it should come with some form of support. Themes from Genesis, Woo, ElegantThemes, and other reputable names in the space DO provide support and updates, so that's a major plus. Services like ThemeForest provide a platform for developers to sell their themes/plugins and do not provide a blanket level of service in return. Instead, each developer is supposed to support their product. My experiences there are mixed...some do a good job, some don't. Because of that, I tend to not buy from places like that and instead give my business to the companies that are known to stand behind their product.