Why do there have to be frequent security updates in first place?
If they didn't manage to tighten up their very limited attack surface in 6 years then I'd say it's a lost cause.
For me the problem is not that they release frequent updates - I would have a problem if they didn't release frequent updates to known severe vulnerabilities. If you look at their release logs you will see that most of their security updates has 24-48 hours of turnaround from the time of the vulnerability detection.
The recent vulnerability that this blog and most others (ie, smashing magazine) got affected has been fixed 2 releases before the current release. People who are affected didn't update for the last 3 release and someone developed a script out there that automatically scans for that vuln. and takes advantage of it.
From a security standpoint Wordpress is a trivial application because it's almost entirely read-only, except for the comments. Making a plugin-architecture bullet proof is a different story, but as I understand it most of these issues affect the very core, i.e. a vanilla wordpress install.
There is no excuse for their sorry state of affairs.