Wordpress is a development stack that happens to have a Page/Post/Categories/Tags schema system. It is much more than a "blog."

It sounds like you didn't know how to secure your server with at least chroot jail, selective port filtering, and njinx injection filtering or apache fail2ban.

I have been running multiple wordpress sites for years and have never had issues. These sites have custom themes I wrote to take advantage of the wp_ apis, to do much more than just blogging.

For example: http://gregoryscoffee.com is done entirely as a custom wordpress theme. The different coffees are actually posts in the Coffees category - their thumbnail is fetched by grabbing the image attachment on each of the posts. In fact, all the dynamic content is stored as posts. The owner has no problem updating the site, since it is all editable in the normal wordpress admin.