This business model is tried and true (WP Curve, GoWP). In fact GoWP has a great white label solution to handle all the maintenance you speak of at a fair cost. I used to combine their service with hosting on WP Engine (which included Sucuri for security) and have a ready made MRR model for WordPress.