Security is a lot easier to reason about on a static site. Especially if you're leaving the server security up to, say Amazon and hosting off of S3 or a CDN.
Was security a huge problem in Wordpress ? I work in the tech industry too, but never came across security as an issue. Or is it about the plugins bringing in the unreliability ?
I haven't looked at Wordpress in years, but it used to have a terrible reputation when it came to security. Hopefully they've improved.
Plugins. The plugins are a never ending stream of XSS, SQLi, and other vulnerabilities. I used to intern on a web security team at Mozilla that hunted down these kinds of things and the entire experience revealed how easy it was to compromise your entire site because of a single plugin. During my six months there, I think I discovered 30+ plugins with issues. Most developers were responsive but some ignored us and the issues were never fixed.
Event without plugins, when your self host your wordpress you'd have to keep up with the updates.
Only having to send a bunch of static files makes it really easy.
I've personally never used Wordpress, but when I look at my server logs, there are always loads of requests from bots trying to attack Wordpress vulnerabilities in particular.
People realized that many pages don't need to be dynamic (especially since native comments on blogs are pretty much dead), and hosting a static site is easier/cheaper than taking care of a dynamic one. Why keep up with patching your CMS or pay someone to do that if it's not necessary?