If people avoid installing plugins and custom themes, and absolutely do not change the theme so that automatic updates have to be turned off, and they also inst

If people avoid installing plugins and custom themes, and absolutely do not change the theme so that automatic updates have to be turned off, and they also install automatic updates, then its pretty fine. As someone who works professionally at a hosting company, no one does this. The history of Wordpress security has followed window XP with users who downloads random files from the internet and click cancel every time something want to update. Every hosting company that I know has to implement firewall rules to address WordPress security, just like the old days of windows. The default configuration is also not fine. At minimum you need to disable rpc calls to the login, as the password attacks trigger a lot work that eats resources and processes. RPC is on per default in order to make the WordPress mobile app work.