Evaluations of two wordpress security plans against php code injection attack

First, both of these things (updates and sane file permissions) are neither “OR” choice or optional. That is what you just do, because if you don’t sooner or later (even if significantly later) you are going to have problems because of it. Relatively I would say updates are more important, because faulty file permissions tend to harm when in already compromised environment (like poorly configured shared hosting).

Second, if you repeatedly experience infection of your site(s) then neither of the two would do anything for you. You have serious hole somewhere, either easily detected to be exploited by automated scanners or someone knows and keeps exploiting manually. Before you determine what that hole is and how to close it any other security measures are pretty much moot.