To the extent that I can draw a conclusion about this, it's that running your own web site, much like running your own email server, is no longer fire-and-forget. Now you have to be continuously worrying about the latest security issue, installing patches regularly, etc., or you need to outsource to somebody else who will do it for you.

And, as it happens, I've got a bunch of web sites that prior grad students set up with WordPress that have been running largely on autopilot for years. I'm now trying to transition these to being "professionally" maintained by our university IT staff for precisely these reasons.