Thanks for the answer.
The security issue is interesting, because Dreamhost do things a bit differently to what I'm used to. Not saying it's necessarily bad mind you... I'm not sure there's an easy way around the stats issue - they could probably chown the stats to your user and provide a cgiwrapped script for viewing them, but maybe that's taking it all a bit too seriously!
I'm not running a commercial site where stats need to be confidential so I'll leave it at that.