I'd love to move client's mostly static sites to Pelican or Hugo. But that means that every time they want to tweak something that isn't content, I get a phone call. So I stick with locked-down* versions of Wordpress, configured to automatically update, and hope for the best. So far, I haven't had any trouble, but if a site did get hacked, I have backups on hand to deploy a new server in seconds.

*Besides best security practices for the server, database and Wordpress install, and clients aren't allowed to install new plugins or tweak the actual source code. The lightweight UI customization that themes provide is usually enough.