Drupal has worked for me for many years, the modules are usually all free to use and to modify... There are very specific ways of doing things to ensure updates

Drupal has worked for me for many years, the modules are usually all free to use and to modify... There are very specific ways of doing things to ensure updates can happen without flaws, it has quite a learning curve, but the security benefits outweigh all of that. Drupal's abstraction layer is what keeps it secure. You also can restrict permissions granularity, and it's core functionality does most of what you need to create a simple site. Administration menus don't change with themes chosen (unless you specify it to). If you have a high traffic site, you can simply use cloud flare, or system caching, or pay for higher tier services like Akamai. I'm not an evangelist for Drupal though, it's not meant to fit every case, so I'll just leave it at that.