I think for most personal/homelab users the issue is more how much attention running WP causes. You see the scans, once they know it is WP it escalates. Very targeted.

I completely agree you can reduce the risk in WP to an acceptable level. It has just become more work than most of us want for hobby projects if you want to do anything more than lock down basic.