Is it good that WordPress has automatic security updates? Yes.
Is it bad that WordPress vulnerabilities are still so common? Yes.
Are Drupal, Joomla, or Magento better at this? It sounds like the answer is probably no.
Does that excuse WordPress because it is better than other frameworks with marginal track records? No.
For such a widely used framework, WordPress' security record is dismal. Automatic updates are a great feature, but they don't replace the need for the framework to be a lot more secure.
For someone hosting their personal blog on a $5/month VPS this is probably good enough. For a bank to run WordPress is borderline professional negligence at this point [1]. A lot of the comments seem to be assuming that because the update was rolled out withing a few hours, that their window of exposure was pretty small. The window of exposure to WordPress vulnerabilities isn't from the time the patch is released until you are updated, it is from when an attacker discovers the vulnerability and you are updated.