Speaking from experience in nation-wide digital media— you're dead spot on.
I have seen sites with 60+ WP plugins enabled. Many outdated, many hacked upon (and poorly, with no documentation). Even the WP instances were modified just slightly and had convoluted build processes that nobody on the current teams could explain (again, with no documentation. Or rather documentation was "TBD" circa 2010).
And all of those WP instances either shared configurations and root style sheets or ran as a multi-site on a single machine with Nginx in front of it only using a mix of Akamai, Cloudflare, and Brightcove to handle some, but not all, non-print media.
The sites were consistently being exploited and having porn uploaded. Issues like that were usually caught quickly enough, but that kind of operation kept the teams busy with patching holes rather than improving performance.
Last I checked their WP sites downloaded 20 Mb of scripts alone on a fresh load, and 6mb thereafter.
Bloody nightmare is right.