To be fair, wordpresses own security is pretty decent. It's more that anyone can develop, publish and install any random set of php code as plugins what makes it so vulnerable. (In my experience at least)