I already had to switch a public facing site to a static site because it was getting defaced every 1-3 years.
The first time I caught them in the act and pulled the NIC on it because from file names it looked like CSAM was being uploaded to it.
After the third time I went static and never looked back.
Comments and search never worked right (or depended on the Wordpress box being reachable by the public at the admin URL anyway.) went through algolia, disqus, updates inevitably broke them again
Between all that and the corporate behavior im ready to move on from WP. The site in question hasn’t been online for several months now and the more I read about this the more I went, it’s time to find something else for this need
What would hacking an HTML file even mean.