Indeed, majority of vulnerabilities originate from the plugins and themes. On average a WordPress website has like 18 plugins installed - 42% of those sites have at least one of those plugins with a known security vulnerability. If you look at critical security vulnerabilities found in plugins in 2021, you see that 29% of those didn't even receive a patch from the original developer. That means users who use those plugins never become aware of security issue in the plugin and WordPress just showed that the plugin is "up to date". The fact that there is 150% more vulnerabilities identified in 2021 compared to 2020 is actually a good sign - it means that there is more attention to security and more issues are being fixed.