Can you elaborate on why you would recommend Wordpress as the "best bet" for a "more or less static site"? I feel like I'm of the completely opposite opinion, that introducing something as modular and dependent as Wordpress for something "more or less static" is just asking for trouble down the line.

In my mind a "more or less static website" will not require a database, it will not require logic server-side, and it will not require the possibility to add-on plugins for extra functionality.

What's beautiful to me about static websites is that the threat vector is now suddenly nothing but the web server, and when you're serving static web pages that's a pretty small threat vector if you've configured it correctly. As soon as you blur the line between "web site" and "web application" and start including things like databases, forms and API:s you're in a completely different territory and I kind of feel like you should choose that because you really, really need it. Not just as a default.

WP is not in anyway static (without plugins) and you will quickly realize that when your site deals with a non-trivial amount of traffic and it completely seizes up.

WP hasn't been a good choice for small business owners for a long time - web security is hard, and hardening a WP install is not simple. There's a ton of options out there that do everything WP does without the overhead: squarespace, weebly, wix, shopify, etc.