>> If hacked sites were really that much of an issue, then WP wouldn't be as popular as it is for business sites.

Business owners have no idea how often they get hacked. They get hacked because business owners want a DIY approach and start installing plugins willy nilly without sandboxing and testing them, making their sites vulnerable to attack

September 2020:

Millions of WordPress sites are being probed and attacked with recent plugin bug

The sudden spike in attacks happened after hackers discovered and started exploiting a zero-day vulnerability in "File Manager," a popular WordPress plugin installed on more than 700,000 sites.

https://www.zdnet.com/article/millions-of-wordpress-sites-ar...

That's a hell of a vector for a hacker. Target one plugin - hit over 700K machines? Unreal.