Composer helps, but it helps developers. It does not help the average user that has no clue on how to apply those patches.
People download a CMS from the internet, throw it on a cheap host and expect it to work. Updates? What are those?
People wouldn't be happy if I started building my own car to just drive around where ever I felt like, making it 'easy' and 'safe' to just throw up a website anywhere is an excellent way to get hacked.
Why? It's not like most websites are mission critical.
Heck, even if a major business website went down for a couple of days, it wouldn't be that much damage anyway compared to other things that can and regularly do happen to the supply chain or market...
>making it 'easy' and 'safe' to just throw up a website anywhere is an excellent way to get hacked
Yeah, and so? Getting hacked is the end of the world?