Any tool turns into shit if not taken care off. Enable auto updates in wp-config.php. Limit login attempts. Use ManageWP to easily manage several WP installations through a single interface. Add a (free) security plugin like Wordfence.

I've been running WP installations for years and never had a problem with them getting hacked.