They're trying the SpaceX "move fast and break things" approach. With WordPress they're certainly going to get the latter with every update :)
It's pretty bad and it really means you have to constantly update them to be reasonably secure. There's a whole service for scanning its vulnerabilities: https://wpscan.com/
Of course every other product has vulnerabilities too but they are not that easily and heavily exploited.
And plugins are unavoidable in the WordPress ecosystem unless you really just need a simple personal blog. Together with the security need to constantly upgrade due to the many vulnerabilities makes it a big headache. You can't afford to leave some updates slide and then you have to deal with all the incompatibilities and issues of plugin updates.