I've been called for two different cases of compromised Joomla installations. In one case, the 1.0 to 1.5 upgrade process was completely broken; I couldn't get it to work without hacking up the upgrade script.

I didn't play around with it long enough to remember anything about its file or database architecture. But, I think if I were going to develop a CMS, I would want to make it easy to patch and upgrade, and I would want to make sure that it was somewhat secure.