In a free world, hacks and cracks will always exist, just like physical break-ins and vandalism will always exist. A system can never be fully secure, but there are lots of guides one can follow to avoid being low hanging fruit.

For a WordPress site, one thing could be, yes, keeping plugins updated. While in general I am a fan of auto-updates and the technology behind, I also oppose it - especially in this time. Centralized systems are very popular in the "hacker communities" (or what they are called), and breaching one would cause major harm. What happens if the auto-update system on wordpress.org is breached? What data does wordpress.org save about websites? When wordpress.org can target very specific websites to be updated, are logs kept about when, where to and what was pushed?
If these questions are already answered somewhere, please show me as I am all in for transparency in that area.

The positive aspects of auto-updates and regular pings wordpress.org do outweigh the negative, but simply stating that auto-updates being turned on for everything will keep a site secure is naive. Let's not turn this fantastic piece of technology into a monster. Education and collaboration are much more important than forced updates.