Wordpress does very well on motte and Bailey - the core is performant and secure, but if you try to do anything with just core, you’re told to install any number of (quite good mind you) plugins.
Most of the time you get a new client and they have a website with a theme and plugins that haven't seen updates in years because the authors abandoned them. You have to constantly fix them. Even if you create the website yourself you really have no way of knowing for how long it will be supported, and even then, you are not going to do a complete security audit of the codebase.
For example because of latest updates to PHP 8 they have deprecated the $var{key} syntax - who the fuck uses that?! I did not even know it existed until some of my clients' websites crashed after I updated PHP.
It's an absolute minefield since we moved on to the PHP 7 branch. I am glad for PHP because the language sucked before because of how lenient it was. But it creates a lot of work for me.
For example because of latest updates to PHP 8 they have deprecated the $var{key} syntax - who the fuck uses that?! I did not even know it existed until some of my clients' websites crashed after I updated PHP.
It's an absolute minefield since we moved on to the PHP 7 branch. I am glad for PHP because the language sucked before because of how lenient it was. But it creates a lot of work for me.