Sure I could run a CMS reasonably secure Drupal Site. But I'm at a successful startup, have had years of experience hardening Websites and know my it-sec hygiene. This also makes me not the target audience for CMSes like Drupal. Most of us agree that having static site generators are a much better solution for most use-cases. The people needing WordPress and Drupal don't know what Usecases they need, they are exploring the possibilities often times.