False equivalence. That the creators of various PHP blogging platforms sucked at security does not invalidate the poster's point that a self-hosted CMS with a simple comment system is indeed much simpler and easier to reason about.
In the 2010s if you left a wordpress blog unattended even with the official default filter plugin it would fill with spam comments. I dont know if thats still a problem.