Running an online system is a responsibility, one which includes keeping up with vendor updates.

Is it possible to run WordPress securely? Absolutely, we do it for 8 million blogs, including some of the most high-target blogs in the world like CNN's.

In the case of WP we consciously take a perception hit versus some of our competitors by not batching security updates every few months but putting fixes out there immediately, even when there's no public disclosure.

I think this worth it though it can be painful in cases like this comment where people have permanently internalized their negative perception of the platform.