Because people who don't actually know how to build websites are fooled into thinking they have a tool that will fill that knowledge gap, despite the security implications that they are oblivious to.
It's the first choice among a huge number of web devs though, which seems contrary to it being that the person deploying it doesn't know better.
It's the Microsoft Word of Web Content Creation, if the people you're building a site for have any pre-existing experience with creating and editing content online it's probably with Wordpress. That puts it ahead of 90% of the opposition off the bat because the client is already comfortable with the platform. Developers like programming more than they like teaching people how to use the sites they built.
When I make a site for a client, I can't always guarantee I'll be available in 6 months, 2 years, 5 years, whatever. Using PHP and Wordpress guarantees they'll be able to find developers in the future.