Plugin vulnerabilities are the #1 security risk
Outdated plugins account for the majority of WordPress security compromises. A telecom site with a dozen active plugins handling coverage, billing, forms, and portal access has a proportionally larger attack surface than a simpler site. One unpatched plugin is all it takes.