WordPress and security

Hi Shaun This is not a specific question, just something I am interested to get your views on as your livlihood depends on wordpress and so does mine. One of the things we all struggle with in the crazy world of the internet is finding ways to make a margin. How can we not applaud the transparency and the global choice we all now enjoy thanks to the internet? No one can pull the wool over anyone's eyes these days, not so long as that person was an internet connection and a mouse. And yet, for the struggling business, this glorious world of instant price comparison makes life very tough indeed. As a web developer I have always struggled to find a path to business valhalla – that is, where your business is making money for you whilst you sleep. My solution has been to create a hosting package which includes maintenance. It's not a big number, around £200 - £400 per year depending on the size of the site. For this you get a bunch of stuff all principally based around security. You get a WAF for instance, regular back ups to a cloud service, an SSL and a promise, that should your site be compromised then we will restore from back up immediately then take the bad site off-line, scrub it clean, plug the hole(s) and put it back up again. Also, your site gets checked by a human-being (me!) twice a week and any plugins, themes and WP versions that need updating get done. But here's the thing, in essence I have monitized something that, in an ideal world, shouldn't be happening. What I am actually saying to my clients (obviously I don't actually say this!) is I have built you a website that, in it's native state, is about as secure a wet paper bag. Oh, and on top of this it's bulky and has the load speed of a three legged tortoise. But don't worry, pay me and I'll make sure none of the terrible things that can and do happen, don't. The client's very reasonable response to this is 'why the hell did you sell me a wet paper bag in the first place?'. Using the car analogy, I sell them a vehicle with a notoriously unreliable and horribly slow engine and then charge them a monthly fee to keep it running and fiddle around under the hood a bit to see if I can get it going a bit faster. Sounds like a right scam! What I'm really asking of you is what is your answer to this? Why, if it's so vulnerable and so slow, am I using Wordpress to build your site and not Wix or Squarespace or Webflow or any number of 'build your own' solutions offered by hosting companies. I have some answers ready but I would love to know how you handle this one. Martin