WordPress core yes, and it's pretty safe, but if you use many plugins (which most people do) that gets a lot riskier. Premium plugs are pretty safe but still I've had stuff break.
The kind of person whose needs would be satisfied by a static site generator doesn't seem likely to need 20 plugins, so it doesn't sound like an apples-to-apples comparison.
I don't base on number of plugins, I base on complexity personally.
I mostly agree with you, but in my experience most (not all) people who are capable of using a static site generator will do so. Those who aren't comfortable with it use WordPress. I'm not slamming WordPress, just making an observation.
