WordPress is the most popular publishing platform on the web, which makes it the biggest single target for automated attacks. A site that's built well and kept up to date stays safe. One left to drift between updates, unmonitored, on cheap shared hosting, carries materially more risk than it did two years ago.
That's why every WordPress build includes the first year of managed WordPress hosting as part of the project: daily backups, security monitoring, plugin and core updates, and rescue cover if anything ever goes wrong. The build is hardened during development, and the hosting keeps it that way. The two are part of the same job, not two separate things to worry about.