Actually, the situation is worse than you make it look. Most sites are running WordPress, which isn't particularly secure out of the box, and only gets worse as poorly written plugins are added.