> If you know what you're doing, WordPress fine.

Probably true, but for whatever reason Wordpress seems to attract an awful lot of people that do not know what they are doing

Anecdote: we contracted a web page, and the guy started saying "it would be a Wordpress. It has very bad press, but it's because it is widely used". Ok, we start developing in the latest version of php, and soon he say "we have to go down a couple phpversions, because x pluging don't work in the latest". Requested version had a dozen critical CVEs. Plugin in question did something really basic, like a preview card with OpenGraph data, or something like that. Something a junior could code in a day.

And that is insecure Wordpress: people lego-mounting sites without touching code, only with plugins.