The people writing modules usually understand hosting environments and take security seriously. The tried and true modules aren't chatgpt slop. WordPress plugins, on the other hand, have tons of vulnerabilities because so many are made by developers who just want something that “works.” If their blog or small shop gets hacked, they just restore a backup no big deal.
As an example, If you use a password manager you are using in a tool/service built specifically for that, with strong encryption and security audits. Now imagine storing your banking passwords in a WordPress plugin instead. Technically it could be just as secure but what if you found out your favorite password manager actually is just a plugin running on wordpress site? Pretty sure anyone who has worked with wordpress for years would instinctively recoil at the idea.
As for if WP core (no plugins) is insecure:
https://www.cvedetails.com/vulnerability-list/vendor_id-2337/Wordpress.html (over 100)
vs
https://www.cvedetails.com/vulnerability-list/vendor_id-10798/Whmcs.html (6 from years ago)
Wordpress just isn't a secure product. Is it good enough for small ecommerce stores and blogs? Totally. Is it good enough for slightly more than that? Sure if you're careful and do everything right. Is it enough for storing medical records, server data, credit card data? Absolutely not.
