Wordpress CORE is relatively secure. They've got a giant team that is always pushing out updates. The trouble usually comes from a variety of plugins and users not updating their Wordpress or not changing default values.

I'm not sure what a good alternative would be unfortunately. I have a HTMLy flat-file blog instance running on I2P that I never update and it's... okay. Pretty simple.