It doesn't seem to have had a secure design from the outset. Worse still, ordinarily one might advise "keep up to date", but wordpress had a release backdoored (http://www.cgisecurity.com/2007/03/wordpress-websi.html) once, so keeping up-to-date isn't without its risks too.
I've been giving tumblr a try, and so far - so good, but the functionality is pretty minimal.
I personally view having security updates as a plus - it shows that the WordPress team (open source community) supports their software. The fact that WordPress is running on 70 million plus websites [1], about 15% of the web [2], means that if a security hole is found, it will be fixed, and it can be fixed by anyone without having to wait for a limited amount of employees of a particular company to write the patch (one of the benefits of open source).
What you do get from Tumblr, though, is the fact that a 3rd party is responsible for keeping your website up and keeping it fast - you basically trade ownership of your website's software for a 3rd-party guarantee. This also means that if Tumblr is down or is hacked or you want to customize something beyond the theme, you are dependent on Tumblr...
So, while each may have its own use-case (Tumblr is great for the following/reblogging stuff), the fact that WordPress is regularly updated is not a reason to avoid using it as a platform.
[1] http://en.wordpress.com/stats/ [2] http://wordpress.org/news/2011/08/state-of-the-word/