Kind of the old Windows vs Mac problem though. It gets so many exploits because it is so ridiculously popular. No one is going to bother looking for exploits in shit that no one uses right? I’m sure they’ve got problems like any project but I’m not convinced they’re THAT bad. Not to mention a lot of exploits you see are plugins doing dumb shit, not WP itself.
If you wait for a good sale, digital is sometimes cheap or cheaper. I just go with whatever is cheapest at any given moment.