And what's the realistic alternative? Many of those sites used to run custom CMS software coded from scratch years ago by some random development agency who farmed the work out to a freelancer who has long since disappeared. Seems doubtful that that's better in any respect.
Edit: Removed my sarcastic tone :)
Is it possible to run WordPress securely? Absolutely, we do it for 8 million blogs, including some of the most high-target blogs in the world like CNN's.
In the case of WP we consciously take a perception hit versus some of our competitors by not batching security updates every few months but putting fixes out there immediately, even when there's no public disclosure.
I think this worth it though it can be painful in cases like this comment where people have permanently internalized their negative perception of the platform.
re: your point about requiring a login to comment. Isn't that good for community building? If MetaFilter let just anyone leave a comment, that would kill it off pretty quickly. Having some barrier to entry can add value, you just need to find the appropriate one for your community.
A blog is "owned" by the author, and comments are from guests who aren't invested enough in the site to register, but who still make up the core of the community.
On a forum, or Metafilter, or Hacker News, the content is produced and owned by every participant who will likely interact over and over and in the process build up their localized reputation and profile on the site as part of their ownership. I think that any of these could be done effectively without registration, but it's not as common.
(I think partly because there are business reasons for registration -- it makes it easier to opt-in people. Even people without the business reasons follow the convention.)