...and when your site is hacked, will it have been worth it?

"Some random WordPress plugin" is usually the main entry point. The core has a bad track record, but plugins are worse by far.