WordPress is still horrific, though.

Not wp core, or the latest core themes.

Everything where users can contribute, plugins and themes can be garbage. Especially on the open market. But as for php development of core… well kinda nightmarerish. But modern theme development with php is a great experience.

Modern themes also recommend moving the frontend templating to JavaScript.

Nearly 99% of my security audits on wp sites is looking for vulnerability from a decade ago.

In terms of security, WP core itself has been incredibly stable.