> hemming a hawing about security comes from people installing suspect plugins

But plug-ins are the reason for using WP and this is often touted. Then people get criticised for using plugins? Indeed the post you’re quoting mentions lots of plugins!

I’ve only very lightly used WP over the years but /every/ plug-in seems suspect