I don't see why Django CMS will be more secure than WordPress or other way.

From a coding point of view, the more people works on it, the more chance the security issue will be noticed and fixed. Rails, Django or any framework in general always have security issues at some time.

The issue of WordPress is come from the easy to use. The ability to install plugin require write permission from the user that run WordPress.

Second, many WordPress plugin expose executable-php file in plugin folder that is invokeable via hitting directly that url.

So if Django CMS has that ability, allow downloading 3rd-code and run it, I'm not sure if it's more secure than WordPress.

WordPress is just as secure as any Rails or Django app. Bug happens, people fix.