You mention the security stuff, but for any site running at scale, it's not really an issue. They don't use a billion plugins and they usually run on infrastruc

You mention the security stuff, but for any site running at scale, it's not really an issue. They don't use a billion plugins and they usually run on infrastructure designed from the ground up to run WP. Heck, A8C's hosting platform (WP VIP) won't let you deploy code that doesn't pass a host of linting rules. I'm working on a site right now for a big company that's moving to VIP. We have 7 plugins, 2 of which are from VIP, and then 4 that the company I work for wrote and now maintains for use across all of our clients. Everything else is custom. The theme is 100% custom. When orgs choose WP, they do it because they want the interface to reduce training costs, and the platform to reduce dev costs because they can take that codebase to dozens of different consultancy agencies and have them pick up where the last people left off.