[davidandgoliath]

It shouldn't be impossible to secure wp as-is, happy to help if need be. Reduce excess plugins, enable automatic updates, avoid plugins that can't be updated via wp.org repo., reset wp salts. You'd likely find it's very reasonable afterwards.

For the editor: Install this, it's supported through 2024 (at least) and will revert the editor to the old version:

https://wordpress.org/plugins/classic-editor/

[Mikealcl]

I think for most personal/homelab users the issue is more how much attention running WP causes. You see the scans, once they know it is WP it escalates. Very targeted.

I completely agree you can reduce the risk in WP to an acceptable level. It has just become more work than most of us want for hobby projects if you want to do anything more than lock down basic.