There is a consistent history of huge vulnerabilities in Wordpress, which is explained by the aforementioned code quality.

For maintenance, well if something breaks (especially plugins, etc), it’s much easier to fix it when the code is clean (like a proper Laravel-based project) than the mess that WP is.

Finally performance isn’t that good again compared to a bespoke Laravel app or a more modern platform (for blogging, Ghost comes to mind).