Themes rarely have hackable exploits due to what they (are supposed to) do. If there's insecure code in there it's probably code with functionality that belongs

Themes rarely have hackable exploits due to what they (are supposed to) do. If there's insecure code in there it's probably code with functionality that belongs in a plugin to start with. Themes that have had vulnerabilities in them tend to be the kinds of commercial themes that are filled with features and 3rd party scripts to satiate users demands. Not really a WordPress core problem, it is a market problem. Although package management is something WordPress lacks in.