I completely agree that WordPress has a huge attack surface. Plugins and crappy themes are mostly to blame, but it appears that small criminal busonneses exist

I completely agree that WordPress has a huge attack surface. Plugins and crappy themes are mostly to blame, but it appears that small criminal busonneses exist to do username/password guessing and brute forcing, and there's a dazzling amount and variety of PHP malware. Yet you hear nothing of this. Infosec people, corporate and government, seem to focus almost exclusively on Windows and APTs. Seems like there's a giant blind spot that engulfs WordPress security. Why?