Ex PHP developer here. The codebase is an absolute nightmare and doesn’t conform to any best practices (it’s not even MVC but a weird mess of .php files, there is no HTTP routing, it’s all very legacy PHP).
I just developed a blog using laravel, and while I see the difference in complexity, I dont see how security/maintenance is affected.
For maintenance, well if something breaks (especially plugins, etc), it’s much easier to fix it when the code is clean (like a proper Laravel-based project) than the mess that WP is.
Finally performance isn’t that good again compared to a bespoke Laravel app or a more modern platform (for blogging, Ghost comes to mind).