I think it’s important consider a few points here:
Although other CMS’ could have been used, they had to pinpoint the most simple to use and understand system for both users accessing the site, as well as the massive amount of contributors using the site internally. Though I personally don’t find Gutenberg that intuitive, I can see it being simple enough for people to get their head around with a bit of training, unlike many of the more “dev” focussed options. Ask an engineer to make a tool and it’ll be the best damn tool for the job, but damned if anyone else knows how to use it but them.

I can see both sides of the vulnerabilities and headaches argument. To say “Hey look! NASA use WordPress, so it must be enterprise grade” is a bit reductive and understates the work they will have done to make it enterprise grade. Even doing a simple a test as accessing wp-admin or wp-login.php shows that they’ve put security measures in place which are definitely not vanilla WordPress. I think it’d be more accurate to say that – with a lot of work – they have adapted it to meet their standard, not that WordPress is of that standard by itself out of the box (which is how a lot of people use it and hence why it is perceived that way).

The community aspect of WordPress is also not to be underestimated, as they’d already mentioned, other options would often result in them having to go back to the CMS vendor for help or clarification if something needed changed or was broken. Although I’ve no doubt they’ll need to go back to Lone Rock Point for further adjustments and additions to the site and blocks they’ve created, if for some reason LRP wouldn’t/couldn’t do the work, they’d be able to easily hire someone else to come in and take up the work at fairly short notice and probably low cost (both important considerations), unlike other, more niche platforms.