Yep - I run my own composer-driven WP setup based on the roots design and can honestly say that it's an anti-pattern with how WP wants to handle plugins/themes/

Yep - I run my own composer-driven WP setup based on the roots design and can honestly say that it's an anti-pattern with how WP wants to handle plugins/themes/core updates/etc. I say it's an anti-pattern because we're talking about WP - a platform that allows you to arbitrarily update PHP files from a web admin/install plugins/etc... It's this sort of flexibility that our clients/end users want and when we start designing that BS out due to security reasons it typically ends up in a user yelling at me for "WHY CAN'T I JUST INSTALL A PLUGIN LIKE THE WORDPRESS TUTORIAL SAYS?!" When you come back with "security", and "I have to review that code" it almost always falls on deaf ears. When you start designing the flaws out of WP infra you start to realize those same flaws are why marketing is hellbent on keeping it as a CMS - they hate working with/waiting on devs to get things done.