You’re not alone, I’ve still got clients with WP sites and it feels more and more patchworky every time I use it. The vulnerabilities may keep me up at night, but it would take a ton of effort to move them over, and my clients certainly don’t want to pay for that.