Static is way more secure. A site with only static pages is more or less impenetrable. Obviously it is more awkward to update.

WordPress was a disaster area at one time, not so much now. But if you look at the kind of attacks your site gets over http/s, it's that kind is stuff which is in the majority.