I agree that the WordPress core is as secure as you can get. I use many premium plug-ins and to date I've had no hassles. I guess it all boils down to where you get your plug-ins from and to always keep them updated to the latest version.