Wordpress is, imo, the reason PHP has historically gotten a bad rap. Needle/haystack/type/performance PHP jibes aside etc etc, WP has been the single point of contact for situations where my company has had to remediate a hack/data breach/script kiddie scrawl. I've seen full hosted servers being unplugged with no comebacks, tens of thousands of dollars in rebuild costs, lost clients due to security concerns.. the culprit? pointing over there

The easy retort is "just keep it patched and up to date", natch. The ongoing costs/technical debt involved in maintaining a Wordpress install sometimes ends up being greater than what it cost to roll the thing out.

Wow, I'm getting old and complainy.