This doesn't sound like the right argument to me. There are lots of link spammers out there. Their goal is to make garbage sites seem more "important" to sear

This doesn't sound like the right argument to me. There are lots of link spammers out there. Their goal is to make garbage sites seem more "important" to search engines by increasing the number of unique sites that link to them. WordPress is targeted because it is a popular enabler of web sites, that can essentially be used to make hundreds of unique sites do your bidding. I have seen similar problems with any pervasive site technology. For instance, I've seen public wiki pages vandalized ("talk" pages with hundreds of lines of links to garbage sites, presumably to make Google find them more relevant). And I've seen problems with PHPBB forums (new "accounts" with profile links to "home pages" that are really just more spam for Google to find). These things don't happen because someone goes to one site, they happen because robots target the popular technologies and try to automatically find sites on the web that are exploitable. You see this with closed-source pervasive technologies (like Windows). It's pretty clear that seeing source code is not necessary to repeatedly perform devastating hacks. In all cases, the correct solution is vigilant and competent administration. Of course if you never change the defaults, you're more vulnerable. Of course if you don't patch your server regularly (these tools are constantly improved), you're open to old hacks. And ultimately, if you choose the popular tool, you can expect more frequent issues.