In reply to jeff.

Unfortunately, it is common for web hosts to be running on outdated software that isn’t supported with security updates anymore.

What’s more concerning with that, is that plenty of those web hosts either own a security provider or are paid to partner with s security provider. So the web host can make money off of security being poor and security providers don’t seem to care that their partner or owners are not handling security appropriately.

The conflict of interest rarely gets mentioned, like how this story about a GoDaddy security breach failed to mention they own Sucuri: https://wptavern.com/godaddy-data-breach-exposes-1-2-million-active-and-inactive-managed-wordpress-hosting-accounts