Yep - this is why I ultimately gave up on hosting Wordpress at all and just went with Pantheon. The managed service to deal with this was easily worth more than constantly being paranoid as to whether I was up to date with the most recent types of Wordpress vulnerabilities.