The headaches are simply not worth it. No designer should be using WordPress for client websites in the age of squarespace/wix. It is just irresponsible to build something for a client that is going to break itself within 1-2 years max.
Wix and alikes are proprietary software, that lock in users on their services, have limited customization options, don't allow you to edit code and have little to no export options.
Whoever pays someone else to have it's website built on wix or alikes is getting a very bad deal, due to the above mentioned restrictions (compared to WP) they'll end up very dissatisfied in few years if things go well (meaning more traffic and more needs).
Source: experience. As a developer I feel the frustration coding for WP, but at the same time it's the best compromise to provide a CMS that the average user can manage
Step 2 is difficult to even define properly. What is a plugin supposed to be able to do, and what is a plugin supposed to not be able to do? If you can answer that question precisely, then you can solve the problem, but if you can answer that question precisely then you probably don't need plugins in the first place.
If you are building a simple brochure website, none of this matters.
edit: For Wordpress only install reputable, necessary plugins. Turn on auto-update. Keep backups. Things should be just fine. Now you aren't locked into a single platform and you can extend your website as much as needed (unlike Squarespace/Wix which severely limit what you can do).
Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.
Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.
'Make sure you keep everything updated!' has a ton of caveats and pitfalls, that's just the reality.
Btw, I'm a senior full stack software engineer. But for my digital media business I operate several Wordpress websites. I don't talk to any Wordpress devs and do any custom Wordpress theme or plugin development (aside from what is available in the GUI and extremely minor CSS tweaks).
https://krebsonsecurity.com/2021/05/using-fake-reviews-to-fi...
Plus: what headaches? Do it well, keep it updated ( uh, yeh, like literally ALL the software, ever ) and it’ll work flawlessly for years.
i set up my first real blog over a decade ago. i picked wordpress, because that seems to be the default, and i didn't know any better. oh my god, i hated maintaining that thing so, so much. it pretty much killed my desire to blog, as a matter of fact.
i recently started another blog, and this time i used a static site generator. i wouldn't recommend such a thing for non-technical people, but if you are willing to get your hands a little bit dirty, it is a hell of a lot easier to fix than wordpress ever was.