>With the frequency that WP sites get attacked, leaving a system in place where an attacker that gets access and can write files that will be executed is just asking for problems.

I do see your point, but wordpress just isn't designed to work that way. And, if you did go through all the hoops to make wordpress okay without write access to files, it still has write access to the database.

I do have other mitigations in place, and feel like the risk profile is fine for what these sites do (informational only).

I'd be happier if the auto update was working as it should though.