He pays $40/mo for all of his sites, and included in that is hourly backups rolling for multiple days, security audits, automatic updates, and the ability to lock down logins to a specific IP.

In the 8 years of hosting with wordpress, he's been under constant automated attack, and never once has a site been compromised. I doubt that is because he is some super computer genius, and more likely its just that his host has a decent offering.

But point still stands, if a host allows you to click a button to launch a wordpress site, that is still easy to do.

The difference in what people think of as "running a website" is at play in this conversation.

Administering a website hosted by WordPress.com isn't the same level of difficulty as being an admin of a LAMP based website on bare metal.

Or (from personal experience helping multiple friends) running Wordpress on a commodity cpanel host.