Security is never a 'solved problem'. There is always a trade-off between usability, performance and security. Think of it this way: You run a server on hardware that no single human understands fully. On top of that, you have some devices for which pretty much the same applies. On top of that you have an operating system consisting of millions of lines of code, and again, nobody can fully grasp everything. On top of that, you have your webstack which adds even more complexity. You are hooked up 24/7 to a network filled with criminals.

Security is not just intrusion prevention, it's also detection and recovery. PE chose to reduce the negative effects of a successful intrusion.

Keep It Simple.

Not storing personal information now removes a whole class of work you have to do. While you store personal information, you need to spend time keeping on top of security patches and issues. It means you need to worry about legal obligations.

If you just don't store it, you don't have to worry about that. You need to spend less time per month maintaining the project. If you're a volunteer project, you might not have the time available to keep on top of it.

Unfortunately security is never a solved problem as there are always new attack vectors beings discovered. I think the statement just reflects their desire to take zero risk. The only way to do so is to avoid storing this information entirely.

The problem is clearly not simple enough that you can, say, show us a CLI two-liner which will deploy a database and frontend that are unbreakable.

Ergo, I find it quite plausible that people who are doing this in their spare time chose to avoid this task.

I'd have to agree, PE isn't a huge website and it isn't really storing sensitive data. I don't see why they're acting like it's impossible to secure their data.