I’ve been in and out of the Wordpress ecosystem for almost the last 20 years. Most “developers” on Wordpress/woo commerce/other popular wordpress plugins are very limited in what they can do. Most of them are limited to assembling code fragments from Stack.

I’d trust a Wordpress developer off fiver to install and configure a plugin, or adjust themes, but not to code and certainly not to understand security fundamentals.