It's been an interesting 6 years. Many attacks we protect against now (XSRF, most types of XSS) were basically unknown then. Some (cryptographic splicing) were popularized by researchers auditing WordPress. A mixed blessing of being popular is that everyone is looking at your code. However we try to turn around fixes as quickly as humanly possible, and with few exceptions (Scoble not upgrading) high profile WordPress blogs (CNN, NY Times) have never had any security problems.