I occasionally working with WordPress sites, and I personally find ACF plugin as a smell when someone tries to bend WordPress into what it already is not.

Pretty much 100% of compromised WordPress sites I get are caused by a plugin like this, be it either a configuration issue or a vulnerability in code.