I am not too surprised by this. When I was doing agency work I was fortunate enough to be able to set a priority for security and build most things from scratc

I am not too surprised by this. When I was doing agency work I was fortunate enough to be able to set a priority for security and build most things from scratch, only using a hand full of utility plugins (e.g. ACF) where I could have at least a glance at the code doing things well. Anyone who has a site valuable enough to do that (and use a git workflow) should be using a framework like Bedrock. I've never had a positive experience with a theme that had a thousand built-in options or even turned WP into a fully blown site builder. The code quality - both of the plugin/theme code and the generated markup - was usually quite bad. I imagine the main audience for managed WP hosting is there.