You are correct. Since WP is GPLv2, there's nothing to prevent a hosting provide installing WP, making changes, and charging for the 'enhanced' service and keeping the code for themselves, because the hosted app isn't being 'distributed' to end users. (There may indeed be some nuance if part of WP is client-side JavaScript...)

And this is exactly the case that Affero GPL was written for. (Affero is a modification to GPLv3.)