You would still have an update problem with wordpress since it's a very popular attack target. One of the things that has made me shy away from using it is fear of running into a problem like "we need to upgrade to version X in order to fix a security issue, but version X breaks plugin Y".

I guess what I was mainly getting at was that prior to around the time that rails and 37s got going the idea of paying monthly for web based Saas hadn't really exploded in the public consciousness (of course this was due to many factors other than 37s and rails).

So web developers who didn't want to do consulting would naturally think of the shrinkwrap type model first as a way of selling software.