Many of those things can be done without an (internet-facing) CMS. You could for example use an internal CMS that generates static HTML which is then pushed to

Many of those things can be done without an (internet-facing) CMS. You could for example use an internal CMS that generates static HTML which is then pushed to a simple webserver with no option to execute code. This is certainly not a panacea, but it will prevent 0-day automated attacks from random botnets.