Wordpress is a media darling because of its apparent "ease", but like so many other things that claim to be easy and feel easy to "the man on the street" that ease comes at prices no legitimate business should be willing to risk.
It is painfully apparent if you look at the default markup and pretty much every single template made for it that those who created it, much less those working with it, are unqualified to write a single line of HTML. It is -- like a great many things -- rooted in outdated pre HTML 4 Strict practices, mindset, and methodology. There's little if any separation of presentation from content, even less in terms of proper semantics, with endless pointless DIV for nothing, endless pointless classes for nothing, JavaScript doing HTML and CSS' job, META tags that not one single legitimate UA cares about, static style in the markup, static scripting in the markup, etc, etc.
The back end code is no better. The mechanism by which all those "plugins/mods/extensions/whatever name is hot and trendy for it this year" function results in so many different entry vectors to the codebase that of course there are going to be endless exploits opened up by them. This is only further exacerbated by the simple fact that WP only has "one ring" security. You get your foot in the door and the whole system can be pwned due to the bad practices.
Such as the outright idiocy of placing the SQL login information into DEFINE, leaving the connection in global scope so any code anywhere in the system has full unfettered access to it, etc, etc. It's like building a castle with 500 doors, one guard, and the keys to the treasure vaults hanging in plain sight behind each and every door.
There's a reason it won the Pwnie Award for M4ss 0wnage back in '09.
... and you're right, the entire selling point is also the number one thing we're told not to do; so which flipping is it?!? Plugins or no? They sucker people in the door with "Look at how easy it is to expand it to do things" and then when things go wrong tell you "Oh you shouldn't use those".
Much less the sheer ridiculous amount of placebo nonsense (like Yoast) that amount to nothing more than throwing more code at it for zero legitimate reason.
It is to that end I jokingly refer to it as Turdpress, as far too many people step in it and then track it all across the Internet's carpets. It's a cute toy for making a personal blog... but as you said people keep trying to make it into something it is for all intents and purposes incapable of being, a serious tool for business.
Simply put, I find those who try to promote it as such to either be utterly ignorant of how badly they are harming their clients, or nothing more than outright con-men.
At least in the case of the former it's forgivable as ignorant just means they don't know any better. Never attribute to malice that which can be adequately explained by incompetence.
The problem is I've dealt with so many people aware of the problems who shrug their shoulder's, go "Oh well", and continue to bald-faced lie to their clients, not caring how dishonest they are so long as they make a buck.
It's just part of why I think developers should be answerable to a code of ethics akin to those found in engineering and medical.