I can't speak for or against WordPress in specific but there is often a need for patching even if you somehow had mythical bug free code and keep things simple

I can't speak for or against WordPress in specific but there is often a need for patching even if you somehow had mythical bug free code and keep things simple there may be compatability with say IPv6 to maintain or what was good enough for the day may now be a sick joke like relying on passwords for cryptographic security.