One reason why I prefer Wordpress is that I can pretty much build anything I want with just 'core' and a very small number of plugins (mostly Advanced Custom Fields, which has a paid version and quite actively developed).

With Drupal, on the other hand, I've always had to install a whole bunch of contrib modules just to get the basic functionality I needed. Has that changed significantly since Drupal 6 and 7?

Am I underestimating how insecure Wordpress core is, even considering that the get the equivalent you'd need Drupal plus a whole bunch of modules?

Drupal 8 now has views as a core module, which so far has allowed me to make custom fields for editors and allow them to relate the data entry with other entries or tags/taxomonies. Its the only CMS I've experienced so far that allows me to make data entry highly customized towards the content being added. I'm not sure what you're specifically looking at, but views is pretty much a big abstraction layer for the database, there's a lot you can do with it.

You need a whole bunch of wp modules to get to the same level has a Drupal 8 core install.