As a blogging platform it's fantastic. If I wrote a blog, it would probably be my first port of call. The problem IME is when people use it to develop complex websites that have no place being built on WordPress. I've had numerous clients over the years asking us to investigate why their website has been hacked and people are receiving dubious links in emails or finding their website serving SEO blogspam, etc.

You rapidly find an insecure spaghetti mess, that's almost unmaintainable, especially when you find loads of random plugins installed and the previous developers cut corners and started hacking code into the core and the plugins, which of course then breaks stuff when you update any of it. Which you need to do. Often.