Baffles me too. A self-hosted WordPress install is pure vanilla and offers plenty of tasty toppings a hacker can integrate via core APIs and theme hooks.