Long ago I was a professional (ha!) Drupal developer, so I maintained my own personal website with Drupal for a while. Way overkill for simple portfolio and blog sites. I’ve been using self-hosted Wordpress for the last 8 years or so. I’ve never had a problem with security by following all the recommended practices: keep WP and all plugins and themes up to date, use the minimum number of plugins possible for the functionality you need, and delete all unused plugins and themes. (If a plugin’s PHP files are on your server, they may still be exploitable even if the plugin is disabled).
I’m a geek who checks the web server logs several times a week. I am amazed by the number of attacks from script kiddies that come in every single day. I see attacks against WP, Drupal, misconfigured Linux file permissions, and many I don’t recognize. I tweaked my web server configuration (Apache .htaccess file) to add extra layers of security for many common exploit attempts I see. Example: I block all access to wp-login and wp-admin pages (except from my own IP address). I also block access to the wp-json API and xmlrpc. There exist security plugins that will do these things, but that means having more plugins installed that themselves might have vulnerabilities.
After reading this thread I’m likely to switch to a static website generator. If you want a fast website, much of the complexity of running WP is setting up and maintaining the caching infrastructure. Using a static website generator will remove tons of complexity in my configuration around performance and security and backups.
I use namecheap for domain registrations and dreamhost for web hosting. I still plan to use them with whatever static website generator I end up choosing.