He pays $40/mo for all of his sites, and included in that is hourly backups rolling for multiple days, security audits, automatic updates, and the ability to lock down logins to a specific IP.

In the 8 years of hosting with wordpress, he's been under constant automated attack, and never once has a site been compromised. I doubt that is because he is some super computer genius, and more likely its just that his host has a decent offering.

But point still stands, if a host allows you to click a button to launch a wordpress site, that is still easy to do.