There's ways that prevent it - - Freeze all code after an update through permissions - Don't make most directories writeable - Don't allow file uploads, or limit file uploads to media

There's a few plugins that do this, but vanilla WP is dangerous.