In reply to Steve.

That is one of the reason why – at least in my bubble – many of the more technically-versed agencies switched to headless WP. Keep the WordPress instance hidden and protected, e.g. by Basic Auth, and only expose a (static) build.

Then you don’t need to worry as much about security updates, because the instance is much more secure by design already. Of course, this has other implications and needs other budgets from a client.