It doesn't. I wrote a whole section on non-WordPress vulnerabilities. But, yes, patient facing sites aren't quite as critical as some of the backend stuff. I

It doesn't. I wrote a whole section on non-WordPress vulnerabilities. But, yes, patient facing sites aren't quite as critical as some of the backend stuff. I spent the last two months trying to contact the people responsible. When I finally did, they said they wouldn't / couldn't do anything :-/