Wordpress is "not handsome code" and has been the source of massive security holes for a decade.

Symfony has problems, to be sure, but it at least establishes certain levels of sanity that you have to do something stupid to break.