The human factor is always a key issue in security. Always has been and always will be. Mullenweg is completely delusional if he thinks that users not updating their sites routinely and not using expensive hosting is a justifiable excuse to deprioritize security within WP core. That’s just downright irresponsible. I would much rather have a secure product than one with a fancy customizer and an API I’ll likely never use. I am getting so tired of constantly worrying about WP security.