WordPress can still be a workable CMS when it is actively maintained, patched, and kept lean. The practical issue is that many business websites accumulate years of plugins, themes, PHP dependencies, admin accounts, and hosting configurations. That makes routine maintenance harder and widens the surface area that needs to stay secure.