Your last paragraph is wrong. WordPress is a headache for people who keep their CMSes up to date. The speech about why Wordpress is a poor choice for a lot of projects has changed over the last decade, but it’s still true to say — possibly truer than ever. PHP is a lot better than it used to be, but not Wordpress-style PHP. There are great CMS alternatives that are also written in PHP and are better, secure, and set up so that they will be around for years.