No they're not. But if you're ok with parotting no-thought tropes, go for it.
It's pretty bad and it really means you have to constantly update them to be reasonably secure. There's a whole service for scanning its vulnerabilities: https://wpscan.com/
Of course every other product has vulnerabilities too but they are not that easily and heavily exploited.
And plugins are unavoidable in the WordPress ecosystem unless you really just need a simple personal blog. Together with the security need to constantly upgrade due to the many vulnerabilities makes it a big headache. You can't afford to leave some updates slide and then you have to deal with all the incompatibilities and issues of plugin updates.