I have a fairly obscure domain that gets absolutely bombarded by wordpress related scans. This tells me two things: wp seems pretty easy to misconfigure, and a lot of scripts are looking for these misconfigurations. Based solely on that I would never recommend it to a tech-naive business.