In reply to Steven Gliebe.

You do realise that this incident exactly contradicts your first point.

WordPress itself was not vulnerable. What failed was the proprietary part of the managed WordPress service.

Otherwise you are right, more poor outcomes from a poor company.