I think your comment just proved the OP's point.

I've had customers using WP in the past, and defacement was just part of the routine. It's an annoyance for the business owner for sure, but so are personnel issues, finance, legislation changes, etc.

For most businesses, there are more important issues than having a perfectly optimised and hardened website.

WP, as bad as it is, is 'good enough' for most websites.