I feel like WordPress sort of "wraps around" (quality horse-shoe, it was so bad but popular that now it's good). Core WordPress is one of the most audited code

I feel like WordPress sort of "wraps around" (quality horse-shoe, it was so bad but popular that now it's good). Core WordPress is one of the most audited codebases on the planet, it has a ton of duct tape and scar tissue. Any new relevant bug classes, people will tend to look for it and fix it in WordPress first, because practically every bounty program has one or more instances somewhere. People aren't doing these kinds of attacks against WordPress plugin distribution because it's uniquely vulnerable. They're doing it because WordPress is incredibly popular. If you need the stuff WordPress can do and can't get away with a static site, IMHO it's usually still the best choice. Main caveats being, plugin quality varies very widely (including at supply chain level), and you can quickly run into issues if you get an agency to customise and they do a bad job.