Even considering Wordpress probably makes up 50% of the compromised sites on the internet, due to its terrible security track record and that nobody patches their own blogs?
You can get auto-updates and we do a pretty good job of protecting WP sites. But the situation is dire. A survey we did recently showed that 38.9% of respondents (out of over 7000 WP site admins) were hacked within the past 12 months.
https://www.wordfence.com/learn/2015-wordpress-security-surv...