Indeed, but using poor ones or not keeping them updated is what causes the wrong opinion that WordPress isn’t solid.

30% of the most popular 1000 websites are built on WordPress supposedly.

Most large publishing companies, the white house and various government departments all use WordPress for their main sites. Its the third party integrations that cause security issues, not the core code.