Because it is safer. With Wordpress and other execution environments your attack vectors will increase.

Why would I use Wordpress if all I need are some static sites and maybe a form?

I would rather use a form handler that processes data that comes from the form and let the other sites be what they are: static sites. So my question in this case is: Why Wordpress?

For me less is more sometimes and I can sleep better when I don't need to watch WP and it's plugins to be updated before the next malicious actor decides to attack half of the internet with an PHP exploit. Of course there is auto-updates for WP itself nowadays but the basic problem is still the same. You use a dynamic programming language though you probably don't need one.

I am also not an advocate of custom markup because I think we already have more than enough flavors now.