This has been largely due to the popularity of WordPress, which attracts a lot of new users as well as developers who are novice to the platform. If there is proper awareness to keep the themes and plugins updated and the use of strong passwords avoids a lot of trouble. Things are improving ever since auto updates have been turned on by default.