The problem I see is that, in many instances, WP is pushed by dodgy developers running a template for what is a static site. This is easily the case for 90%+ of the small business sites I see. Many are never changed.
WordPress is a much larger attack surface than static hosting. There are fairly obvious ways of automating using WordPress to generate a static site that will be faster and more secure. I believe this is generally referred to as headless WordPress. Why does this not happen more – or do I just not see it when it does?