With WordPress, there's always the possibility of your blog being hacked, because it executes queries and there's always the chance for bugs to exist some where in the huge ocean of code. On the other hand, with static blog generators (like specter, octopress, pelican, etc) your generated blog will be static html and as far as I know, there's no way you can really question html's security, simply because security doesn't apply to it. You cannot attack html because it doesn't run queries or anything, it's just static data being pulled from the server and displayed by the browser. So, in the end, the security goes back to your host and how good the machines are configured (when you're using shared hosts).