As a security aware person, wordpress self hosting is kind of terrifying. At the very least, keep it on a dedicated VM and away from anything you care about.
As another security interested person (who does not claim to be anything remotely near an expert), my suggestion is to have a static site, generated using something like Jekyll. Most blogs don't need server-side code running, and Disqus works great for comments.
Absolutely. Some people like wordpress for irrational reasons, but Jekyll is awesome (what I use).