Next.js, and most likely all the big players, can achieve that. I use Prismic for a lot of projects, and here's documentation about how to achieve previews with it and Next.js https://prismic.io/docs/technologies/previews-nextjs
Yeah, easy, all you have to do is rewrite WordPress in JavaScript. Now instead of worrying about malware in plugins, you can worry about malware in plugins and your npm dependencies!
sounds like much worse than wordpress from the get go
The problem with WP is that its being run in a privileged position. A statically generated site is not.
You shouldn't run your web server as root. I think the most common way of running WordPress is to use nginx in front of Apache, so you can easily run Apache as a special WordPress user for extra security.
Sorry, my terminology wasn't clear. Didn't really mean running it as root, meant that WP has direct access to your DB (it must).
Every backend has access to your DB though. If a WordPress alternative supports plugins, it is just as vulnerable. If it doesn't support plugins, it's not a WordPress alternative for most use cases.
you don't run your fpm processes as superuser.
In general it is run in a jailed environment.