Isn’t just the “Windows” of the internet? It’s heavily used, directly exposed to the internet, so it’s a bigger target, hence more bugs a found (and exploited).
If you'd have ever looked at the WordPress source code, you know why it's been having a crappy track record. It's one of the easiest example of "don't code like this".
The 'poor track record' reputation comes from the giant number of mom-and-pop sites that got compromised. I imagine 40% of the web is really just a handful of massive commercial websites that have developers on hand to take care of security, backups, devops etc.
Anything highly-used will be a larger target by default I'd guess.
Those issues went away with the automatic updates feature.
Not if you choose your plugins and theme carefully.