I work for a company that got its wordpress sites nastily hacked many times, and I also came to the conclusion that the only to secure this thing is (to update regularly and) to serve static pages. I have imagined a workaround with the module WP-Super Cache in order to achieve that. I'm just saying that their is, sadly, a need for this.