While there are vulnerabilities in WordPress, most of the security issues stem from bad user practices, like not updating the WordPress core, plugins and themes, using hacked plugins, using nulled themes and so on. If you follow user best practices and choose a secure host, like Kinsta, most security issues are preventable.