WordPress is a popular way to develop websites. It’s free price is attractive. It’s well supported. And it’s very flexible.
But the ever-present nature of WordPress means that it also attracts less desirable elements who seem to delight in destroying the work of others.
Which means that in much the same way as you wouldn’t think of running Windows without up to date anti-virus software, you need to keep your WordPress installation as secure as possible.