Thanks for giving an example. I'd say that you can definitely take advantage of the functionality provided by views without having accounts that are able create

Thanks for giving an example. I'd say that you can definitely take advantage of the functionality provided by views without having accounts that are able create and modify them on your production site. In fact it's accepted as the right way to do things. Without more serious examples I can't really agree with your conclusion that it's full of design decisions encouraging insecurity. When it comes to serious security issues that have needed patching I'd say Drupal has a fairly decent track record. It certainly has better defaults and less serious security issues compared to WordPress. I admit that is not saying much but WP has been becoming more and more popular as a CMS and that is what Drupal often gets compared to.