I disagree. WP pushes security updates up often. There's a huge emphases on security with each major update as well. It's poor plugin development that opens up other security issues. Plus the damn thing powers 25% of the websites on the internet, of course it's a big target. I have seen tons of WP sites hacked, all literally all were on shared hosting or way way out of date, which turns out is the main issue here, not WP.

Perhaps less so if you use a wordpress hosting service.

What about security?

And what maintenance? Hitting update every few weeks?

+1. It's hell.