But I've been writing web software for 30 years and WordPress is among the worst mainstream applications. It's worse than its PHP competitors at the time, and it's worse than Ghost and many of the competitors that came after it.

You can't just dismiss all criticism of the past because it was the past. Some people wrote worse software than others in the past, just as they do today.

And as worse is better predicted, all new ones went insecure, with less features, but nicer looking themes.