WordPress on its own can be kept moderately secure, as can any other major script in this market. But if you're installing themes and plugins without knowing exactly what they're doing, then you're gonna have security problems regardless of the script. Doesn't matter if its WordPress, Drupal, Joomla, Magento or anything else, third party plugins and themes are usually the weakest part of the site.
As a dev, I've come across plenty of out of date CMS/ modules/ plugins that had huge security holes in them. It's part of the 'build and forget' mentality that seems to be widespread these days.
Revslider is a "premium" plugin, which means you buy the plugin, and then, optionally, ongoing support, which includes updates.
You can logon to Wordpress and there's a big "click here to update all your plugins" button. And you press it, and it will say "you are fully updated now!" or something to that effect.
To update revslider, you're supposed to use your support agreement to logon to the distributor's website, and go download and install an update separately. I've seen dozens of revslider deployments and I've never yet had a developer believe there was anything more to it than pressing the "automatic update" button, which basically lies to you in the case of premium plugins.
I'm perfectly happy blaming Wordpress - because it needs a mechanism of saying "nope, this plugin requires a support agreement. It is however, vulnerable".