Everything you say about Wordpress is totally true in my experience. But I expect this team is in a much better position than most Wordpress hosts in terms of s

Everything you say about Wordpress is totally true in my experience. But I expect this team is in a much better position than most Wordpress hosts in terms of security potential. For the scale of someone like Wired, I expect they have an internal network they can restrict the administrative interface to. And I would also presume they are doing some aggressive caching to a CDN or to some sort of dedicated public-facing servers that. There's no reason to even worry about letting Wordpress itself respond directly to user requests. Or if they do, they can trim out the riskiest bits of code--no reason to run a vanilla install. This sort of separation would pretty much negate the standard issues with Wordpress's security.