Sorry for the late reply. There's no single reason for it being so insecure, but you don't need to search for long to find vulnerabilities.

I think the main problem comes from the fact that much of the code still resembles the spaghetti that was written over 10 years ago. Even recent versions have problems with basic input sanitization, which makes injection attacks really easy. Social engineering is also a massive problem: if you can phish an admin login, you can essentially take over the entire web server because the admin panel is just too powerful.

He can't.