In my experience it's quite the opposite. It's not perfect, but it's safe enough for most users.

As long as you have WP updated, and a good configuration with your stack (PHP, MySQL, Nginx) it's hard to hack.

The main vulnerabilities come from 3rd party plugins and themes, and shared hosting with older versions of the stack. It's like faulting windows for vulnerabilities in an external .exe app.

If you use the default setup, and follow security guidelines, you should be ok.