Yes, though the plugin system itself has really no rails at all. Any plugin can do anything.
And it's almost always older versions of plugins that are vulnerable; however, at some point a plugin update will break the website and then you don't upgrade because there's more important things to do ...
It's the dependency loop of Wordpress really - people can't update the core because their plugins don't work with new core (yet, sometimes never), so their (outdated) core remains an exploit.
Not strictly a Wordpress issue, this happens with any CMS that allows third party modules (Drupal, for one, as I know from direct experience).
The core main task is execute millions of actions/hooks offered without any control to be exploited by plugins. So "not hacking the core of wp" is really "hacking the core of wp"