This is true, but I would hope that readers here know enough to at least keep WordPress up-to-date. Most attacks target old exploits. There are millions of small WordPress sites that may never get hacked if they stay updated. If you become big enough, however, you become a much more likely target for zero-days. In that case, you probably don't want to be running WordPress any more than you want to be running Windows.