WordPress powers a large share of the web precisely because it is extensible. That same extensibility is why an unmaintained install becomes a security problem.
The non-negotiables
- Core and plugin updates applied on a schedule, tested before they go live
- Daily backups that someone has actually restored from
- Malware scanning with a defined cleanup path
- Uptime monitoring that alerts you before your customers do