More often than not it comes down to the horrifyingly confusing documentation, inconsistent UX, hilarious over-promising the world + dog on landing pages, etc.
Also, exfiltrating a website from Wix (changing the nameservers, which should take two seconds, like it does with any other hoster) is a huge ordeal. They make it very difficult.
My stance is if I'm doing X, my preference is to find software or a platform that does X but not X, Y and Z.
I can see how the lack of plugins may make it more secure though. I haven’t tried Wix, but squarespace is pretty good for getting something out the door quickly. It’s quite limited otherwise and the customization of wordpress makes it a very appealing CMS for most.
If WP provides security screens for add-ons and integrates it into their hosting business it would protect their ecosystem moat.
The problem is none of them are interested in turning a basic CMS into a wasteland of kitchen sink functionality that aims to turn blogging software into the ultimate web swiss army knife.
People are happy to build blog software, but that's not what WordPress' customer base wants. They want professional services in the form of a grab bag of sketchy plugins. Nobody's going down that path again.
If the goal were simply "let's build a better blogging platform" or "let's build a better storefront platform" or "let's build a better music venue website platform" there might be a receptive audience. But the goal is "let's build all three in one and also 500 other use cases." Who would see that as a compelling goal in 2022.