* If you host yourself it is a lot of maintenance to keep wordpress patched, spam cleared, etc.
* It is dynamic, so each page needs to be built based on a query to the mysql database. For a handful of users this is no big deal. If you hit the HN front page your site will be overloaded.
On the other hand, Wordpress is good if you blog on the go and want to use the ipad app or whatever to post/maintain your blog. It might also be good if you have multiple contributors, or update your blog so frequently (minutes) that rebuilding the site to deploy it is an impediment.
Octopress / Jekyll is a good alternative:
* Content is pre-formatted HTML files, no database to get in the way or slow things down.
* Tons of people use it, so it is well known.
* Lots of publishing options -- github, heroku, s3 + cloudfront, etc.
* "Features" like discussion forums can be linked in from disqus or other purpose-built services.
* Publishing is easy via running a script, although that means lugging your laptop around or using an ssh client on your tablet.
* With static HTML the attack surface is substantially less compared to a PHP site with a back-end database, so security should be significantly better and easier to deal with.
* Wordpress now auto-updates, so you don't have to worry about patches.
* WPSuperCache is a Wordpress plugin that serves up static content. Only logged in users see a dynamic page.
The downside is that it's popular (thus a target), and left unpatched or unprotected it's easy to mess something up and become part of those Viagra ad rings ;) I've hosted, set up, or fixed dozens of WordPress blogs, and a few have been compromised for one reason or another (you find lots of PHP shells in upload directories).
Not to mention the fact that once you get outside the basic use case (blogging), and/or you start using plugins, things get convoluted FAST. There're a million plugins for WP, and if you're lucky the one you pick will do exactly what you want. But chances are it won't, and you'll spend hours digging through spaghetti code to get it to work for you.
Also I think the WP core is well secured. It's when you start adding plugins into the mix things can get dicey.
For spam, Akismet is pretty effective and comes with WP by default, just have to enable it. I consider WP very frictionless for publishing content so it's a good choice in my book.