The "surprisingly secure" WordPress just had a unauthenticated RCE earlier this year. Just simplifying isn't going to be enough.
If that's your benchmark for being unsecure, then React is unsecure too.
https://react.dev/blog/2025/12/03/critical-security-vulnerab...
loading story #49606564
WordPress and secure don't go together in the same sentence.
I mean the base is fairly secure if you religiously update it, but the problem is you won't avoid using plugins whose security is much more hit and miss, unless you are using the most basic blog site imaginable.
"First step"
Nobody said it's enough, but it's a start.