Again, they're using a hosted service. They aren't on the hook for security updates, wordpress.com is.

What do you propose is the simpler, more pragmatic solution to standing up a blog, compared to going to wordpress.com and registering a free tier account?