It shouldn't be impossible to secure wp as-is, happy to help if need be. Reduce excess plugins, enable automatic updates, avoid plugins that can't be updated via wp.org repo., reset wp salts. You'd likely find it's very reasonable afterwards.
For the editor: Install this, it's supported through 2024 (at least) and will revert the editor to the old version: