The Python user base is perfectly fine. Of course, any additional package installed outside of Django and Wagtail can introduce security risks. Since Wagtail and all of its additional packages incorporates Django's security features, which includes protection against many common attack methods, it is a more secure offering.

https://docs.djangoproject.com/en/4.2/topics/security/

Not to mention security through obscurity, Wagtail is a lot less common than Wordpress. Therefore, not as many attack vectors exist for Wagtail as they do for Django / Wagtail, especially if you keep on top of the security patches.

https://www.djangoproject.com/weblog/2023/sep/04/security-re...