And the files can certainly be edited as they aren’t immutable.
They are less resource intensive and easier to maintain, but aren’t immune.
(Running mostly static sites converted from Wordpress sites, but also running 10 year old+ word press sites that haven’t been changed in forever)
If you have Wordpress exposed to the internet, there's a lot more security stuff to deal with.
What would hacking an HTML file even mean.
After that I added a cron job that compared the hash of the index.html with a precomputed value. Didn't change often enough to be a hassle.
There's no DB with juicy data and no compute to abuse for mining crypto or running DDOS attacks.
There’s less payoff, but people still do it.
Your source of truth for a static site will never be the deployed contents of the server (even if you do go that route). It will be your local Git repo or possibly your upstream Git forge.
Even in the rare case that such a simple case gets you hacked, you can throw away your entire setup and start over quite easily. Whereas all of the Wordpress/Drupal/etc/etc. options I'm aware of will require you to do your own database backups, if you are self-hosting, or else you are simply hosed (as the attacker could corrupt or erase the source of truth).
If you are with a hosted solution then obviously your security (and backups) will be as good as their security/backups, and all of this will be moot except for pricing.
I think static sites are a good technique that has vastly improved security over dynamic sites, but thinking that using them makes you invincible is faulty.