For what it's worth, the vast majority of compromised sites we look at are because of host vulnerabilities or issues rather than something at the WordPress layer, which is pretty far up the stack.

An up-to-date WordPress, which is easier than ever using the built-in upgraders, is secure. There are more bad sysadmins in the world than people who can't click the upgrade button.