In which case you’re back again in PHP land.
In my mind a "more or less static website" will not require a database, it will not require logic server-side, and it will not require the possibility to add-on plugins for extra functionality.
What's beautiful to me about static websites is that the threat vector is now suddenly nothing but the web server, and when you're serving static web pages that's a pretty small threat vector if you've configured it correctly. As soon as you blur the line between "web site" and "web application" and start including things like databases, forms and API:s you're in a completely different territory and I kind of feel like you should choose that because you really, really need it. Not just as a default.
WP hasn't been a good choice for small business owners for a long time - web security is hard, and hardening a WP install is not simple. There's a ton of options out there that do everything WP does without the overhead: squarespace, weebly, wix, shopify, etc.