WordPress updates breaking existing sites was your original complaint. Now it's "but there are lots of plugins with security exploits".
And plugins are unavoidable in the WordPress ecosystem unless you really just need a simple personal blog. Together with the security need to constantly upgrade due to the many vulnerabilities makes it a big headache. You can't afford to leave some updates slide and then you have to deal with all the incompatibilities and issues of plugin updates.